Memory Exhaustion Vulnerability in Twisted Framework by Twisted

CVE-2026-115775

What is CVE-2026-115775?

The Twisted framework, which supports Python 3.6 and above, has a vulnerability in its twisted.words.xish.domish ExpatElementStream parser. This flaw allows an unauthenticated remote peer to keep a container element open indefinitely while continuously adding child elements. As a result, the parser retains the incomplete stanza in memory without any limits on bytes or element counts. This issue can lead to severe server memory exhaustion during XMPP pre-authentication stream parsing, potentially resulting in process termination. The vulnerability has been addressed in version 26.10.0rc1.

References