redhat/python3.11-twisted vulnerabilities

Latest redhat/python3.11-twisted CVEs

Newest publication first

1. CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

   Published 2026-10-23

   Medium·CVSS 5.4

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header l...

2. CVE-2026-83813 Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

   Published 2026-10-23

   Low·CVSS 3.1

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from...

3. CVE-2026-115778 Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

   Published 2026-10-23

   High·CVSS 7.5

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum...

4. CVE-2026-115776 Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

   Published 2026-10-23

   High·CVSS 7.5 EPSS 0.50%

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.wor...

5. CVE-2026-115775 Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

   Published 2026-10-23

   High·CVSS 8.7 EPSS 0.44%

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The...

6. CVE-2026-115774 Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

   Published 2026-10-23

   Medium·CVSS 4.9 EPSS 0.52%

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the sele...

7. CVE-2026-106454 Twisted: IMAP wildcardToRegexp() ReDoS

   Published 2026-10-06

   Medium·CVSS 4.3 EPSS 0.42%

   Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.