In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other… (CVE-2026-106454)
Description
In Twisted versions 25.5.0 and earlier, the wildcardToRegexp() function in twisted/mail/imap4.py improperly handles certain IMAP pattern characters by passing them directly to Python's regular expression compiler. This allows an authenticated client to craft patterns that cause catastrophic backtracking, leading to a denial of service by suspending all server input and output during the match. No fixed release is currently available.
CVSS v3.1
Score 4.3medium
Affected software
pkg:deb/ubuntu/twisted?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/twisted?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/twisted?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/twisted?arch=source&distro=focalpkg:deb/ubuntu/twisted?arch=source&distro=jammypkg:deb/ubuntu/twisted?arch=source&distro=noblepkg:deb/ubuntu/twisted?arch=source&distro=stonkingpkg:deb/ubuntu/twisted?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Twisted is an event-driven framework for internet applications supporting Python 3.6 and later. In versions 25.5.0 and earlier, the function wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk (*) and percent (%) wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(). This behavior allows an attacker to supply nested or complex regular expression constructs that cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, this blocking match suspends all server input and output for the duration of the match, effectively causing a denial of service. As of the review date, no fixed release is available.
Potential Impact
An authenticated client can cause a denial of service by triggering catastrophic backtracking in the regular expression engine, which blocks the Twisted server's single-threaded reactor. This results in suspension of all server input and output during the match, potentially disrupting service availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, limiting authenticated client access or applying external mitigations to restrict complex pattern inputs may reduce risk, but no vendor-recommended mitigations are documented.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-106454
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f4eb2cdf04f656656df1
Added to database: 10/17/2026, 22:21:31 UTC
Last enriched: 10/17/2026, 22:37:38 UTC
Last updated: 10/17/2026, 22:37:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.