Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted.
A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
twisted:twisted
References 4
https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
https://github.com/twisted/twisted/pull/12751
https://github.com/twisted/twisted/pull/12751
https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb8…
https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0
https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1