CVE-2026-115774

Name	CVE-2026-115774
Description	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151938

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
twisted (PTS)	bookworm, bookworm (security)	22.4.0-4+deb12u1	vulnerable
	trixie	24.11.0-1	vulnerable
	sid, forky	26.4.0-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
twisted	source	(unstable)	(unfixed)			1151938

Notes

[trixie] - twisted <no-dsa> (Minor issue)
https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v
https://github.com/twisted/twisted/pull/12764
Fixed by: https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741 (twisted-26.10.0rc1)