CVE-2026-115778

Name	CVE-2026-115778
Description	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151938

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
twisted (PTS)	bookworm, bookworm (security)	22.4.0-4+deb12u1	vulnerable
	trixie	24.11.0-1	vulnerable
	sid, forky	26.4.0-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
twisted	source	(unstable)	(unfixed)			1151938

Notes

[trixie] - twisted <no-dsa> (Minor issue)
https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr
https://github.com/twisted/twisted/pull/12750
Fixed by: https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529 (twisted-26.10.0rc1)
Fixed by: https://github.com/twisted/twisted/commit/5d91cc66a3591faba758a80a1479e0103602facc (twisted-26.10.0rc1)