CVE-2026-115776

Name	CVE-2026-115776
Description	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151938

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
twisted (PTS)	bookworm, bookworm (security)	22.4.0-4+deb12u1	vulnerable
	trixie	24.11.0-1	vulnerable
	sid, forky	26.4.0-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
twisted	source	(unstable)	(unfixed)			1151938

Notes

[trixie] - twisted <no-dsa> (Minor issue)
https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798
https://github.com/twisted/twisted/pull/12771
Fixed by: https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30 (twisted-26.10.0rc1)
Fixed by: https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059 (twisted-26.10.0rc1)