An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server (twisted.web) that allows a remote client to exhaust server CPU resources by rapidly sending a pattern of request headers with END_STREAM followed immediately by stream resets. This causes the server to render each request fully before processing the reset, bypassing the concurrent-stream limit and enabling unbounded CPU consumption on a single connection. The issue affects Twisted version 26.4.0 and is identified as CVE-2023-44487 with a high severity rating.
CVE-2026-83813 is a vulnerability in the Twisted framework's DNS client UDP transport (twisted.names.dns.DNSDatagramProtocol) where DNS responses are accepted based only on matching transaction IDs without validating the source address. This allows an off-path attacker who can send UDP packets to the resolver's port to spoof DNS responses. The standard Twisted DNS client mitigates this by using per-query random source ports, increasing entropy, but the missing source address validation remains a weakness, especially for code using DNSDatagramProtocol directly. The CVSS score is low due to the attack complexity and limited impact.
The Autobahn Python permessage-brotli implementation inflates entire frames before enforcing the maxMessagePayloadSize limit, allowing a small compressed frame to cause excessive memory allocation (e.g., 421 bytes inflating to about 545 MiB). This can be exploited by unauthenticated WebSocket clients to cause a denial-of-service via memory exhaustion on servers that enable permessage-brotli compression. The issue bypasses previous fixes intended to limit message payload size. A fix is available in version 0.24.0_5.
CVE-2026-115877 is an HTTP request smuggling vulnerability in the Twisted HTTP server (twisted.web.http.HTTPChannel) affecting versions 26.4.0 and earlier. It arises from incomplete validation of header values, allowing bare carriage return (CR) or line feed (LF) characters to be included, which can cause a front-end proxy and Twisted to interpret request boundaries differently. This discrepancy enables an attacker to smuggle unauthorized requests past front-end controls, potentially bypassing access restrictions, poisoning shared connections, and caching responses improperly. The vulnerability does not allow code execution and requires a front-end proxy that treats bare CR or LF as line terminators. A proof-of-concept demonstrates how an attacker can smuggle a GET request hidden inside a POST request's headers. The CVSS score is 5.4 (medium severity).
An unauthenticated remote denial of service vulnerability exists in the Twisted conch telnet transport. The flaw allows a remote attacker to send a telnet subnegotiation sequence without a terminating byte, causing an unbounded memory allocation in a per-connection buffer. This buffer grows indefinitely until the process is terminated by the operating system due to memory exhaustion. The vulnerability affects Twisted version 26.4.0 and later versions including >=0.9.2 of the related product. There is no impact on confidentiality or integrity, and no code execution is possible.
An unauthenticated remote denial of service vulnerability exists in the Twisted words IRC server due to an unbounded line buffer in the IRC protocol implementation. The server accumulates incoming data without line feeds indefinitely in memory, leading to exhaustion of server resources and process crash. This affects Twisted versions 26.4.0 and earlier. No authentication is required to exploit this, and the denial of service causes all connected users to be dropped until the server is restarted. There is no impact on confidentiality, integrity, or code execution.
An unauthenticated remote denial of service vulnerability exists in the Twisted words domish XML element stream. An attacker can open an XML stream and send a container element without closing it, continuously streaming child elements. Each child element is retained in memory because the container is never closed, causing unbounded memory growth. This leads to memory exhaustion and potential server process termination. The vulnerability affects Twisted version 26.4.0 and occurs before authentication in protocols like XMPP. There is no impact on confidentiality, integrity, or code execution.
CVE-2026-115774 is a denial of service vulnerability in the Twisted IMAP4 server affecting versions 26.4.0 and earlier. An authenticated client can send a SEARCH command with a negative literal size, causing an infinite loop in the parser. This freezes the single-threaded reactor, halting all IMAP connections and any other services running in the same process until it is restarted. There is no impact on confidentiality or integrity, and no code execution is possible.
The msgpack-python C extension has a memory leak vulnerability triggered when deserialization rejects a map key with strict_map_key validation enabled (default). This causes unbounded memory growth and potential denial of service when processing attacker-controlled MessagePack data. Additionally, the streaming Unpacker API may suffer from use-after-free or double free errors due to stale parser-stack references. The issue affects msgpack-python version 1.2.2 and development commits, with a fix available in version 0.24.0_5. The pure-Python fallback does not exhibit the memory leak. Exploitation can lead to denial of service but no data confidentiality or integrity impact is reported.
CVE-2026-77528 is a vulnerability in Autobahn Python's WebSocket implementation where the maxMessagePayloadSize limit is enforced on compressed frame length before decompression, allowing an attacker to send a small compressed frame that inflates to a much larger size. This bypasses the intended resource boundary and can cause the application to process messages larger than configured limits.
MessagePack for Python contains a vulnerability where reusing the Unpacker object after an error can cause a process crash due to an out-of-bounds read. This can lead to a denial-of-service (DoS) condition when unpacking untrusted input repeatedly. A patch is available in version 0.24.0_3, and the recommended practice is to discard and recreate the Unpacker after an error to avoid crashes and incorrect data processing.