Twisted's DNS client UDP transport (twisted.names.dns.DNSDatagramProtocol) accepts DNS responses based solely on matching the 16-bit transaction ID without validating the source address. This allows an attacker able to send UDP packets to the resolver's port to inject forged DNS responses, enabling off-path DNS response spoofing or cache poisoning. The standard client mitigates this risk by using per-query random source ports, increasing entropy, but the missing source address validation remains a security gap. This affects all versions prior to 26.10.0rc1, where the issue is fixed.