Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

影響: pip:Twisted <= 26.4.0 → 26.10.0rc1

An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-mem…

在 GitHub Advisory Database 阅读

2026/10/24 05:45，GitHub Advisory Database 发布了“Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-115776。