CVE-2026-106454 twisted CVE debrief

Who should care

IMAP service operators and administrators who use Twisted IMAP servers should assess their exposure and prioritize verification of their configurations. This includes reviewing and verifying server configurations, implementing compensating controls, and upgrading to a patched version of Twisted if available. Additionally, security teams and vulnerability management teams should be aware of the potential impact of this vulnerability on their systems and be

Why it matters

The CVE-2026-106454 vulnerability in Twisted's IMAP implementation allows an authenticated IMAP client to cause a denial-of-service (DoS) attack by sending a specially crafted pattern string. IMAP service operators and administrators should assess their exposure and prioritize verification of their configurations.

• Potential denial-of-service (DoS) attacks against IMAP servers due to ReDoS vulnerability.
• Possible degradation of IMAP server performance due to blocking regex matches.
• Need for verification of Twisted IMAP server configurations to ensure they are not vulnerable.

Technical summary

The `wildcardToRegexp()` function in `twisted/mail/imap4.py` is vulnerable to ReDoS attacks due to its conversion of IMAP LIST/LSUB wildcard patterns to Python regular expressions. An authenticated IMAP client can send a quoted pattern string containing arbitrary regex syntax, including catastrophic-backtracking constructs, which can cause a blocking regex match to freeze all I/O on the server. The vulnerability exists because the function substitutes IMAP wildcards (`*` → `(?:.*?)` and `%` → `(?:(?:[^/])*?)`) but passes every other character through unchanged to `re.compile()`.

Defensive priority

IMAP service operators and administrators should assess exposure and prioritize verification of Twisted IMAP server configurations.

Recommended defensive actions

• Review and verify Twisted IMAP server configurations to ensure they are not vulnerable to ReDoS attacks.
• Implement compensating controls, such as rate limiting or monitoring, to detect and prevent potential attacks.
• Upgrade to a patched version of Twisted, if available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in the `wildcardToRegexp()` function in `twisted/mail/imap4.py`, which converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. An authenticated IMAP client can send a quoted pattern string containing arbitrary regex syntax, including catastrophic-backtracking constructs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.