## Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

- 種別: advisory
- 重大度: low
- 関連技術: python
- CVE: CVE-2026-83813
- 公開日時: 2026-10-27T14:45:29.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jj36-9pvh-vj5r)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jj36-9pvh-vj5r

影響: pip:Twisted <= 26.4.0 → 26.10.0rc1
twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client (twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail), accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID matching. It never checks that the response actually originated from the server the query was sent to. Any host that can deliver a UDP packet to the resolver's listening port with the correct transaction ID c…