{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/twisted-matrix-laboratories/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115778"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Twisted (\u003c 26.10.0rc1)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","python","telnet","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["Twisted Matrix Laboratories"],"content_html":"\u003cp\u003eTwisted versions prior to 26.10.0rc1 are vulnerable to a memory exhaustion denial-of-service attack. The vulnerability exists within \u003ccode\u003etwisted.conch.telnet.Telnet.dataReceived\u003c/code\u003e, which fails to enforce a maximum length on the subnegotiation buffer when processing data following an IAC SB (Interpret As Command Subnegotiation Begin) signal. Because this Telnet option negotiation occurs prior to authentication, an unauthenticated remote attacker can continuously send data bytes without the required IAC SE (Interpret As Command Subnegotiation End) terminator. This causes the buffer to grow until the application process exhausts memory and terminates, affecting all services hosted by that Twisted instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a process-wide crash, causing a denial-of-service for the affected application and all services managed by that specific Twisted process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Twisted to version 26.10.0rc1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not feasible, implement network-level controls to restrict access to services running the Twisted Telnet implementation to trusted IP ranges.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic directed at Twisted-based services for unusually long or high-frequency Telnet option negotiation sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T20:00:57Z","date_published":"2026-10-29T20:00:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-twisted-telnet-dos/","summary":"An unauthenticated attacker can trigger a process-wide memory exhaustion denial-of-service in Twisted versions prior to 26.10.0rc1 by sending a specially crafted, unterminated Telnet subnegotiation sequence.","title":"Twisted: Memory exhaustion denial-of-service in Telnet implementation (CVE-2026-115778)","url":"https://feed.craftedsignal.io/briefs/2026-10-twisted-telnet-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Twisted Matrix Laboratories","version":"https://jsonfeed.org/version/1.1"}