Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1
An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-mem…
Read on GitHub Advisory Database
| CVE | CVE-2026-115776 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/24/2026, 01:50 PM |
| Data | Markdown JSON |
On 10/24/2026, 05:45 AM, GitHub Advisory Database published "Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-115776.