## Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-115776
- 公開日時: 2026-10-23T20:45:35.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-53xc-49m8-p798)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-53xc-49m8-p798

影響: pip:Twisted <= 26.4.0 → 26.10.0rc1
An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-mem…