{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "twisted: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/twisted--twisted/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/twisted--twisted/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115778/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115778/",
   "title": "CVE-2026-115778 · twisted · disclosed",
   "content_text": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.",
   "date_published": "2026-10-23T20:20:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115778/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115778/",
   "title": "CVE-2026-115778 · twisted · fixed upstream (PyPI)",
   "content_text": "Fixed versions: twisted 26.10.0rc1.",
   "date_published": "2026-10-23T20:20:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115776/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115776/",
   "title": "CVE-2026-115776 · twisted · disclosed",
   "content_text": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.",
   "date_published": "2026-10-23T20:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115776/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115776/",
   "title": "CVE-2026-115776 · twisted · fixed upstream (PyPI)",
   "content_text": "Fixed versions: twisted 26.10.0rc1.",
   "date_published": "2026-10-23T20:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115775/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115775/",
   "title": "CVE-2026-115775 · twisted · disclosed",
   "content_text": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.",
   "date_published": "2026-10-23T20:16:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115775/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115775/",
   "title": "CVE-2026-115775 · twisted · fixed upstream (PyPI)",
   "content_text": "Fixed versions: twisted 26.10.0rc1.",
   "date_published": "2026-10-23T20:16:29Z"
  }
 ]
}