AZL-111416: CVE-2026-115774 affecting package python-twisted 22.10.0-6

Q: Who can exploit this issue?

An attacker needs to authenticate to the IMAP service, enter the selected mailbox state, and send a SEARCH command containing a negative literal size. Services are exposed only where Twisted's IMAP4Server is in use; SMTP or POP3 services are also disrupted if they share the same single-threaded process.

Q: What is the operational impact of a successful exploit?

The parser enters a non-terminating synchronous loop that freezes Twisted's single-threaded reactor. Existing and other IMAP connections, plus any SMTP or POP3 services hosted by that process, stop responding until the process is restarted.

Q: What can be done if upgrading is not immediately possible?

Restrict IMAP access to trusted authenticated users and monitor for unresponsive Twisted service processes. If exploitation occurs, restarting the affected process restores service, but does not remove the underlying vulnerability.

Published Oct 23, 2026

Updated

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

Affected Software

1 affected component

azure-linux/python-twisted<=22.10.0-6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python-twisted to a version that resolves this vulnerability.
Fixed in 26.10.0rc1

Event History

Oct 23, 2026

Advisory Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115774

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to authenticate to the IMAP service, enter the selected mailbox state, and send a SEARCH command containing a negative literal size. Services are exposed only where Twisted's IMAP4Server is in use; SMTP or POP3 services are also disrupted if they share the same single-threaded process.

What is the operational impact of a successful exploit?

The parser enters a non-terminating synchronous loop that freezes Twisted's single-threaded reactor. Existing and other IMAP connections, plus any SMTP or POP3 services hosted by that process, stop responding until the process is restarted.

What can be done if upgrading is not immediately possible?

Restrict IMAP access to trusted authenticated users and monitor for unresponsive Twisted service processes. If exploitation occurs, restarting the affected process restores service, but does not remove the underlying vulnerability.

AZL-111416: CVE-2026-115774 affecting package python-twisted 22.10.0-6

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of a successful exploit?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of a successful exploit?

What can be done if upgrading is not immediately possible?