Threats affecting pkg:brew/alot

An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server (CVE-2023-44487). A remote client can rapidly send a request header with END_STREAM followed immediately by a stream reset, causing the server to render the request before processing the reset. Because reset streams are freed and do not count against the concurrent-stream limit, this can be repeated at line rate on a single connection, exhausting CPU resources. This vulnerability affects Twisted version 26.4.0 and is classified as high severity with no confidentiality or integrity impact.

A vulnerability in twisted.names.dns.DNSDatagramProtocol allows DNS response spoofing due to missing source address validation. The protocol accepts DNS responses based solely on matching transaction IDs without verifying the source address, enabling off-path attackers to inject forged DNS answers. While the standard twisted.names.client.Resolver mitigates this risk by using per-query random source ports, direct use of DNSDatagramProtocol or reuse of the same source port removes this protection. This flaw affects all consumers of twisted's DNS client UDP transport, including twisted.mail's MX lookups.