AZL-111413: CVE-2026-115778 affecting package python-twisted 22.10.0-6

Q: Who can exploit this issue?

Any unauthenticated peer that can establish a Telnet connection to a service using the affected Twisted Telnet implementation can trigger it. Telnet option negotiation happens before authentication.

Q: What does an attacker need to send?

The attacker must send an IAC SB sequence and continue sending bytes without sending the IAC SE terminator. This causes the persistent subnegotiation buffer to grow without a maximum length.

Q: What is the likely impact?

Continued input can exhaust process memory, terminating the affected process and every service hosted by that process.

Q: Which versions contain the fix?

The issue is fixed in Twisted version 26.10.0rc1. Versions prior to 26.10.0rc1 are affected according to the available information.

Published Oct 23, 2026

Updated

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

Affected Software

1 affected component

azure-linux/python-twisted<=22.10.0-6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python-twisted to a version that resolves this vulnerability.
Fixed in 26.10.0rc1

Event History

Oct 23, 2026

Advisory Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115778

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated peer that can establish a Telnet connection to a service using the affected Twisted Telnet implementation can trigger it. Telnet option negotiation happens before authentication.

What does an attacker need to send?

The attacker must send an IAC SB sequence and continue sending bytes without sending the IAC SE terminator. This causes the persistent subnegotiation buffer to grow without a maximum length.

What is the likely impact?

Continued input can exhaust process memory, terminating the affected process and every service hosted by that process.

Which versions contain the fix?

The issue is fixed in Twisted version 26.10.0rc1. Versions prior to 26.10.0rc1 are affected according to the available information.

AZL-111413: CVE-2026-115778 affecting package python-twisted 22.10.0-6

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

What is the likely impact?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

What is the likely impact?

Which versions contain the fix?