Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1
twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client (twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail), accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID matching. It never checks that the response actually originated from the server the query was sent to. Any host that can deliver a UDP packet to the resolver's listening port with the correct transaction ID c…
| CVE | CVE-2026-83813 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 27. 오후 11:45, GitHub Advisory Database에서 "Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: Python. CVE: CVE-2026-83813.