Event-based Framework Twisted Vulnerability in IMAP4Server

CVE-2026-115774

What is CVE-2026-115774?

The Twisted framework, which supports event-driven internet applications, is vulnerable in its IMAP4Server component. When an authenticated client issues a SEARCH command after entering the mailbox state, a negative literal size is processed, causing the parser to encounter negative indexing. This results in a non-terminating synchronous scanning loop that can effectively freeze the reactor, halting all other active IMAP connections as well as SMTP and POP3 services hosted within the same process. The issue can lead to significant service interruption requiring a restart to restore functionality. An update to version 26.10.0rc1 addresses this vulnerability.

References