Memory Exhaustion Vulnerability in Twisted Framework by Twisted

CVE-2026-115778

What is CVE-2026-115778?

The Twisted framework, an event-based platform for internet applications in Python, suffers from a memory exhaustion issue due to how it handles Telnet option negotiations. Specifically, the twisted.conch.telnet.Telnet.dataReceived method appends every byte received after IAC SB to a persistent subnegotiation buffer without setting a maximum length. This oversight allows an unauthenticated peer to manipulate the buffer by omitting the expected terminator, which leads to unbounded buffer growth. As memory usage escalates unchecked, this can ultimately terminate the process and disrupt any services hosted by it. The vulnerability is addressed in version 26.10.0rc1.

References