CVE-2026-83813: Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Twistedto a version that resolves this vulnerability.Fixed in 26.10.0rc1
Event History
Frequently Asked Questions
Which Twisted DNS usage patterns are most exposed?
Applications that reuse a DNSDatagramProtocol instance are more exposed after the first query, because an attacker need only search the 16-bit transaction-ID space. The standard twisted.names.client.Resolver is harder to attack off-path because it selects a new random source port for each query.
What does an attacker need to exploit this issue?
An attacker must be able to deliver a UDP packet to the resolver's listening port and correctly match the transaction ID of a pending query. No authentication or user interaction is required.
What is the available remediation?
Upgrade to Twisted version 26.10.0rc1, which fixes the missing source host and port validation for DNS responses.