Denial of Service Vulnerability in Twisted Framework by Twisted

CVE-2026-42304

What is CVE-2026-42304?

The Twisted framework, an event-driven networking engine for Python, is susceptible to a Denial of Service (DoS) attack due to a flaw in the twisted.names module. Attackers can exploit this vulnerability before version 26.4.0rc2 through specially crafted TCP DNS packets that contain complex compression pointers. This design flaw allows the processing logic to be bypassed, leading to severe resource exhaustion. Consequently, the single-threaded reactor becomes overwhelmed, causing the server to hang during recursive DNS lookups and preventing legitimate traffic from being processed. The vulnerability has been addressed in version 26.4.0rc2, which mitigates the risk by enhancing the processing of DNS queries.

References