CVE-2026-115778 twisted CVE debrief

Who should care

Defenders responsible for Twisted installations should assess exposure and potential impact. This includes reviewing system configurations, checking for updates, and implementing compensating controls where necessary.

Why it matters

CVE-2026-115778 is an unauthenticated remote denial-of-service vulnerability in the Twisted conch Telnet transport. The issue arises from an allocation-without-limits vulnerability (CWE-770) that allows any unauthenticated remote peer to exhaust server memory over a single connection by streaming bytes without sending the `IAC SE` terminator.

• Memory exhaustion attacks can lead to denial-of-service
• Unauthenticated remote access allows for exploitation
• Lack of length checks in the `Telnet.dataReceived` method enables the vulnerability

Technical summary

The vulnerability is caused by an unbounded subnegotiation buffer in the Twisted conch telnet transport. This allows an attacker to exhaust server memory by streaming bytes without sending the `IAC SE` terminator. The issue is located in the `Telnet.dataReceived` method where every non-`IAC` byte is appended to the `self.commands` list without a length check. The affected product deployments should be reviewed for exposure, and compensating controls should be implemented to mitigate the vulnerability. Defenders should prioritize verifying exposure of Twisted installations to this vulnerability and assess the potential for memory exhaustion attacks.

Defensive priority

Defenders should prioritize verifying exposure of Twisted installations to this vulnerability and assess the potential for memory exhaustion attacks. This involves reviewing system configurations, checking for updates, and implementing compensating controls where necessary.

Recommended defensive actions

• Verify exposure of Twisted installations to this vulnerability
• Assess the potential for memory exhaustion attacks
• Review system configurations and check for updates
• Implement compensating controls where necessary
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is caused by an unbounded subnegotiation buffer in the Twisted conch telnet transport. This allows an attacker to exhaust server memory by streaming bytes without sending the `IAC SE` terminator. The issue is located in the `Telnet.dataReceived` method where every non-`IAC` byte is appended to the `self.commands` list without a length check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.