Twisted: Three unauthenticated remote memory-exhaustion DoS vulnerabilities in words IRC, XMPP XML stream, and conch telnet parsers (CVE-2026-115776, CVE-2026-115775)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-115775, CVE-2026-115776, CVE-2026-115778
On 2026-10-22/23 Twisted published three reviewed GitHub advisories for unauthenticated remote denial-of-service flaws fixed in 26.10.0rc1, all affecting versions <= 26.4.0. (1) CVE-2026-115776: the words IRC server's dataReceived buffers line-feed-free input with no length cap; 60 MB sent grew a test server from ~47 MB to ~2966 MB RSS, crashing the single-threaded process and dropping all users. (2) CVE-2026-115775: the xish domish XML element stream (used by XMPP servers) materialises an unbounded element tree when a peer never closes a container, parsed before authentication. (3) A third advisory covers the conch telnet transport, where an unclosed IAC SB subnegotiation grows a per-connection buffer without limit. All are CWE-770/CWE-400 allocation-without-limits issues requiring no credentials; no confidentiality, integrity, or code-execution impact. Fixes are in Twisted 26.10.0rc1.
What to do
- Upgrade Twisted to 26.10.0rc1 or later wherever it is installed, prioritising hosts running twistd words (IRC/XMPP) or conch telnet services exposed to untrusted networks
- If upgrading is not immediately possible, restrict network access to Twisted IRC/XMPP/telnet endpoints (firewall, VPN, or reverse proxy limits) and add connection/memory limits or rate limiting at the perimeter
- Monitor Twisted-based services for abnormal memory growth and set process memory limits (e.g. ulimit, container limits) so a single connection cannot exhaust the host
- Inventory dependent applications (8500+ dependent repos) for bundled or vendored Twisted and schedule their updates
Fixed versions
Sources
All live incidents on Threat Watch