{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/twisted-matrix-labs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115776"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Twisted (\u003c 26.10.0rc1)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","python","framework"],"_cs_type":"advisory","_cs_vendors":["Twisted Matrix Labs"],"content_html":"\u003cp\u003eTwisted versions prior to 26.10.0rc1 are vulnerable to a denial of service (DoS) condition in the \u003ccode\u003etwisted.words.protocols.irc.IRC.dataReceived\u003c/code\u003e method. The component fails to enforce maximum line lengths or clear per-connection buffers for data received without line feeds. This behavior is inherited by the \u003ccode\u003etwisted.words.service.IRCUser\u003c/code\u003e server subclass. Because the buffering occurs prior to authentication commands, an unauthenticated attacker can connect to an IRC service and send a continuous stream of bytes to deplete available memory, causing the server process to crash and affecting all users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to memory exhaustion and total denial of service for the target IRC server process. This is a remote, unauthenticated vulnerability that does not require login credentials to execute.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Twisted framework to version 26.10.0rc1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement edge protection to rate-limit or drop unauthorized IRC connections.\u003c/li\u003e\n\u003cli\u003eReview server resource utilization monitoring for anomalous memory growth trends in applications utilizing the \u003ccode\u003etwisted.words\u003c/code\u003e IRC modules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T22:05:04Z","date_published":"2026-10-23T22:05:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-twisted-dos/","summary":"The Twisted framework contains a memory exhaustion vulnerability in its IRC protocol implementation that allows unauthenticated remote attackers to crash the server process by sending unbounded data streams without line feeds.","title":"Twisted: Denial of service via IRC buffer exhaustion (CVE-2026-115776)","url":"https://feed.craftedsignal.io/briefs/2026-10-twisted-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Twisted Matrix Labs","version":"https://jsonfeed.org/version/1.1"}