Hi,

The following vulnerabilities were published for twisted.

CVE-2026-115774[0]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1,
| twisted.mail.imap4.IMAP4Server reaches
| twisted.mail.imap4.parseNestedParens with a negative literal size in
| an authenticated SEARCH command after the client enters the selected
| mailbox state. The negative size moves the parser cursor below zero,
| and Python's negative indexing prevents the synchronous scanning
| loop from terminating. The loop freezes the single-threaded reactor,
| stopping other IMAP connections and any SMTP or POP3 services hosted
| in the same process until restart. This issue is fixed in version
| 26.10.0rc1.


CVE-2026-115775[1]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1, the
| twisted.words.xish.domish ExpatElementStream parser allows an
| unauthenticated remote peer to keep a container element open while
| continuously adding child elements. The parser retains the
| unfinished stanza as an in-memory tree without a byte or element-
| count limit, and XMPP pre-authentication stream parsing exposes this
| behavior before credentials are accepted. A single connection can
| therefore exhaust server memory and terminate the process. This
| issue is fixed in version 26.10.0rc1.


CVE-2026-115776[2]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1,
| twisted.words.protocols.irc.IRC.dataReceived retains all bytes
| received without a line feed in its per-connection buffer and
| applies no maximum line length. The twisted.words.service.IRCUser
| server subclass inherits this behavior, and buffering occurs before
| PASS, NICK, or USER authentication commands. An unauthenticated
| connection can continuously grow the buffer until the shared server
| process runs out of memory and drops all users. This issue is fixed
| in version 26.10.0rc1.


CVE-2026-115778[3]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1,
| twisted.conch.telnet.Telnet.dataReceived appends every byte received
| after IAC SB to a persistent subnegotiation buffer until IAC SE is
| received, without applying a maximum length. Telnet option
| negotiation occurs before authentication, so an unauthenticated peer
| can omit the terminator and continuously grow the buffer. The
| resulting memory exhaustion can terminate the process and every
| service it hosts. This issue is fixed in version 26.10.0rc1.


CVE-2026-115877[4]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1,
| twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an
| HTTP header value but accepts a bare carriage return or bare line
| feed. Because Twisted splits header lines only on CRLF, a hidden
| Content-Length header can remain folded into another value while a
| lenient front end treats the bare character as a line terminator.
| The resulting framing disagreement can smuggle a following request
| past front-end access controls, poison a shared connection or cache,
| and expose a later client to the wrong response. This issue is an
| incomplete-fix residual of earlier Twisted request-smuggling
| protections. This issue is fixed in version 26.10.0rc1.


CVE-2026-83813[5]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. Prior to 26.10.0rc1,
| twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for
| a pending query when its 16-bit transaction ID matches but does not
| verify that the response came from the queried host and port. An
| attacker able to deliver a packet to the resolver's listening port
| with the correct transaction ID can inject a forged answer. The
| standard twisted.names.client.Resolver uses a new random source port
| for each query, increasing off-path attack complexity, while
| applications that reuse a DNSDatagramProtocol instance expose only
| the transaction-ID search space after the first query. A successful
| forgery can redirect hostname resolution and enable mail
| interception, server-side request forgery, or man-in-the-middle
| positioning. This issue is fixed in version 26.10.0rc1.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115774
https://www.cve.org/CVERecord?id=CVE-2026-115774
[1] https://security-tracker.debian.org/tracker/CVE-2026-115775
https://www.cve.org/CVERecord?id=CVE-2026-115775
[2] https://security-tracker.debian.org/tracker/CVE-2026-115776
https://www.cve.org/CVERecord?id=CVE-2026-115776
[3] https://security-tracker.debian.org/tracker/CVE-2026-115778
https://www.cve.org/CVERecord?id=CVE-2026-115778
[4] https://security-tracker.debian.org/tracker/CVE-2026-115877
https://www.cve.org/CVERecord?id=CVE-2026-115877
[5] https://security-tracker.debian.org/tracker/CVE-2026-83813
https://www.cve.org/CVERecord?id=CVE-2026-83813

Regards,
Salvatore