Twisted: Remote denial of service via unbounded XML stanza in words.xish.domish
Summary
Twisted, a Python event-based networking framework, contains a flaw in the XML stream parser used for XMPP in twisted.words.xish.domish. An unauthenticated remote peer can keep one container element open and keep adding child elements, and the parser stores the unfinished stanza in memory without a size or element-count limit. Because this happens before authentication, a single connection can exhaust server memory and terminate the process.
Affected
- Twisted versions before 26.10.0rc1
- Affected component: twisted.words XMPP XML stream parser (domish)
- Only applications that use this parser, for example an XMPP service built on Twisted, are affected
Fixed in
- Fixed in Twisted 26.10.0rc1 (pre-release)
- Fix commit: 8873814bec8288e2466fad4d2c4d64039beb88b0
- A later stable release (26.10.0) is reported to include the fix; verify on the release page before rollout
Workaround
- No vendor-documented workaround known.
- If the XMPP listener is not needed, disable it or restrict access to its port with a firewall until the upgrade is done.
Exploitation
- The vendor advisory reports a proof of concept was confirmed against version 26.4.0. Public availability unverified.
- CISA SSVC assessment lists exploitation as PoC, automatable: yes, technical impact: partial.
- No evidence of active exploitation in the wild found; not checked against CISA KEV.
Our recommendation
- Inventory Python environments for Twisted, including transitive dependencies such as Scrapy, and identify any XMPP listener.
- If an XMPP service is exposed to the internet, upgrade to 26.10 as a priority (prefer the stable release after verifying it) and restrict access to the XMPP port in the meantime.
- If not exposed, upgrade in the normal patch cycle and document the triage.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3476-c5c2-fr73 github.com
- Twisted 26.10.0rc1 release github.com
- Fix commit 8873814 github.com
- Pull request #12751 github.com
- OSV CVE-2026-115775 osv.dev
- GitLab advisory CVE-2026-115775 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:24.
Original description (NVD)
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.
NVD references (5)
- https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0
- https://github.com/twisted/twisted/pull/12751
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
- https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
- https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.