Xml-Parsing - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/xml-parsing/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 21:48:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTwisted: Unauthenticated remote memory exhaustion in domish XML stream (CVE-2026-115775)https://feed.craftedsignal.io/briefs/2026-10-twisted-xml-dos/Fri, 23 Oct 2026 21:48:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-twisted-xml-dos/The Twisted XML element stream library is vulnerable to memory exhaustion, allowing unauthenticated remote attackers to trigger a denial of service by sending unbounded, unclosed XML element trees.Twisted contains a vulnerability in twisted.words.xish.domish where an unauthenticated remote peer can exhaust server memory through a specifically crafted, unclosed XML element tree. The ExpatElementStream parser fails to implement depth or child-count limits during XML streaming. By sending a container element and continuously streaming child elements without an end tag, an attacker forces the server to materialize every element in memory, retaining the entire tree until the process reaches memory limits and is terminated. This exploitation occurs during initial protocol negotiation, such as XMPP, before any authentication takes place.

Impact

Successful exploitation results in a remote denial of service via memory exhaustion, causing the host process to be terminated by the operating system. There is no impact on confidentiality or integrity, and no potential for remote code execution.

Recommendation

  • Upgrade the Twisted package to the latest version once a fix is released.
  • Implement pre-authentication XML stream size and duration limits at the application or load balancer layer for all services utilizing twisted.words.xish.domish for untrusted input.
  • Monitor application memory metrics for anomalous, sustained growth during the connection negotiation phase for XMPP services.
]]>highadvisorydenial-of-servicememory-exhaustiontwistedxml-parsing