Threats tagged 'brew-scrapy-cve-2026-106454'

CVE-2026-106454 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Twisted framework's IMAP implementation. The function wildcardToRegexp() improperly compiles user-supplied IMAP wildcard patterns into regular expressions without escaping non-wildcard characters, allowing crafted patterns to cause catastrophic backtracking. Because Twisted uses a single-threaded event loop, this blocking regex match can freeze all server I/O, resulting in denial of service. An authenticated IMAP client can exploit this by creating a mailbox with a specially crafted name and issuing a LIST command with a malicious pattern, causing the server to hang for extended periods.