Threats tagged 'brew-magic-wormhole-cve-2026-106454'

CVE-2026-106454 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Twisted framework's IMAP implementation. The function wildcardToRegexp() improperly compiles user-supplied IMAP wildcard patterns into Python regular expressions without escaping non-wildcard characters. This allows an authenticated IMAP client to craft regex patterns that cause catastrophic backtracking, blocking the single-threaded Twisted reactor and freezing all server I/O. An attacker with valid IMAP credentials can create a mailbox with a specially crafted name and issue a LIST command with a malicious pattern to stall the server for extended periods. The vulnerability is fixed in Twisted version 0.24.0_6 by properly escaping non-wildcard characters before regex compilation.