{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/xml-parsing/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-115775"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Twisted (\u003c= 26.4.0)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","memory-exhaustion","twisted","xml-parsing"],"_cs_type":"advisory","_cs_vendors":["Twisted"],"content_html":"\u003cp\u003eTwisted contains a vulnerability in \u003ccode\u003etwisted.words.xish.domish\u003c/code\u003e where an unauthenticated remote peer can exhaust server memory through a specifically crafted, unclosed XML element tree. The \u003ccode\u003eExpatElementStream\u003c/code\u003e parser fails to implement depth or child-count limits during XML streaming. By sending a container element and continuously streaming child elements without an end tag, an attacker forces the server to materialize every element in memory, retaining the entire tree until the process reaches memory limits and is terminated. This exploitation occurs during initial protocol negotiation, such as XMPP, before any authentication takes place.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a remote denial of service via memory exhaustion, causing the host process to be terminated by the operating system. There is no impact on confidentiality or integrity, and no potential for remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eTwisted\u003c/code\u003e package to the latest version once a fix is released.\u003c/li\u003e\n\u003cli\u003eImplement pre-authentication XML stream size and duration limits at the application or load balancer layer for all services utilizing \u003ccode\u003etwisted.words.xish.domish\u003c/code\u003e for untrusted input.\u003c/li\u003e\n\u003cli\u003eMonitor application memory metrics for anomalous, sustained growth during the connection negotiation phase for XMPP services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T21:48:41Z","date_published":"2026-10-23T21:48:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-twisted-xml-dos/","summary":"The Twisted XML element stream library is vulnerable to memory exhaustion, allowing unauthenticated remote attackers to trigger a denial of service by sending unbounded, unclosed XML element trees.","title":"Twisted: Unauthenticated remote memory exhaustion in domish XML stream (CVE-2026-115775)","url":"https://feed.craftedsignal.io/briefs/2026-10-twisted-xml-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Xml-Parsing","version":"https://jsonfeed.org/version/1.1"}