Buffer Overflow Vulnerability in Twisted Framework Affects IRC Protocol Processing
CVE-2026-115776

7.5HIGH

Key Information:

Vendor

Twisted

Status
Twisted
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115776?

An issue in the Twisted framework's IRC protocol handling allows unauthenticated connections to exploit the lack of a maximum line length limit and continuous buffer growth. This can lead to server memory exhaustion, causing the process to crash and drop all users. The flaw exists in the dataReceived method of twisted.words.protocols.irc.IRC, which retains received bytes without line feeds. This vulnerability is resolved starting with version 26.10.0rc1.

Affected Version(s)

twisted < 26.10.0rc1

References

https://github.com/twisted/twisted/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/twisted/twisted/pull/12771
x_refsource_MISC
https://github.com/twisted/twisted/commit/01f8cff7753c1ed...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.