CVE-2026-115774
mediumTwisted is an event-based framework for internet applications, supporting Python 3.6+.
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741 security-advisories@github.com
- https://github.com/twisted/twisted/pull/12764 security-advisories@github.com
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1 security-advisories@github.com
- https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v security-advisories@github.com
- https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v 134c704f-9b21-4f2e-91b3-4a467353bcc0