AZL-111410: CVE-2026-115776 affecting package python-twisted 22.10.0-6

Q: Who is exposed to this issue?

Servers using twisted.words.service.IRCUser are exposed because that subclass inherits the unbounded buffering behavior. The affected code processes incoming data before PASS, NICK, or USER authentication, so unauthenticated clients can trigger it.

Q: What does an attacker need to do to exploit it?

An attacker needs to establish a connection to the affected IRC service and continuously send data without a line feed. This causes the per-connection buffer to grow until the shared server process exhausts memory and drops users.

Q: Is authentication required for exploitation?

No. Buffering occurs before IRC PASS, NICK, and USER authentication commands are processed.

Q: What version fixes the issue?

The issue is fixed in Twisted version 26.10.0rc1. Versions prior to 26.10.0rc1 are described as affected.

Published Oct 23, 2026

Updated

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

Affected Software

1 affected component

azure-linux/python-twisted<=22.10.0-6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python-twisted to a version that resolves this vulnerability.
Fixed in 26.10.0rc1

Event History

Oct 23, 2026

Advisory Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115776

Frequently Asked Questions

Who is exposed to this issue?

Servers using twisted.words.service.IRCUser are exposed because that subclass inherits the unbounded buffering behavior. The affected code processes incoming data before PASS, NICK, or USER authentication, so unauthenticated clients can trigger it.

What does an attacker need to do to exploit it?

An attacker needs to establish a connection to the affected IRC service and continuously send data without a line feed. This causes the per-connection buffer to grow until the shared server process exhausts memory and drops users.

Is authentication required for exploitation?

No. Buffering occurs before IRC PASS, NICK, and USER authentication commands are processed.

What version fixes the issue?

The issue is fixed in Twisted version 26.10.0rc1. Versions prior to 26.10.0rc1 are described as affected.

AZL-111410: CVE-2026-115776 affecting package python-twisted 22.10.0-6

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is authentication required for exploitation?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is authentication required for exploitation?

What version fixes the issue?