Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

影響: pip:Twisted <= 26.4.0 → 26.10.0rc1

An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is…

Read on GitHub Advisory Database

On 10/24/2026, 05:45 AM, GitHub Advisory Database published "Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-115775.