CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.
Засегнати продукти
- twisted twisted: < 26.10.0rc1
Вид слабост
История
- 23 октомври 2026 Публикувано
Други уязвимости в twisted twisted
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-115775
- https://nvd.nist.gov/vuln/detail/CVE-2026-115775
- https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
- https://github.com/twisted/twisted/pull/12751
- https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1