CVE-2026-42304
Fixed in a distro release EPSS <1%CVSS 7.5
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.
Products: twisted
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | twisted | 26.4.0rc2 |
| PyPI | twisted | 26.4.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-twisted | 22.4.0-129.amzn2023.0.6 |
| Amazon Linux 2023 | python3-twisted+tls | 22.4.0-129.amzn2023.0.6 |
| Chainguard | awx | 24.6.1-r49 |
| Chainguard | synapse | 1.151.0-r4 |
| Debian 12 | twisted | no fix |
| Debian 13 | twisted | no fix |
| Debian 14 | twisted | 26.4.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-Twisted | 24.10.0-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Twisted | 24.10.0-160000.3.1 |
| Ubuntu 20.04 LTS | twisted | no fix |
| Ubuntu 22.04 LTS | twisted | 22.1.0-2ubuntu2.7 |
| Ubuntu 24.04 LTS | twisted | 24.3.0-1ubuntu0.2 |
| Ubuntu 25.10 | twisted | 24.11.0-1ubuntu0.1 |
| Ubuntu 26.04 LTS | twisted | 25.5.0-5ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | twisted | no fix |
| Ubuntu Pro 16.04 LTS | twisted | no fix |
| Ubuntu Pro 18.04 LTS | twisted | no fix |
| openSUSE Tumbleweed | python-Twisted | 26.4.0-1.1 |