Read the docs
TI-2026-30612 Aliases CVE-2026-42304GHSA-grgv-6hw6-v9g4

Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial twisted (twisted): 26.4.0rc2Twisted (PyPI): 26.4.0rc2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
twistedtwistedbefore 26.4.0rc226.4.0rc2Patch availableCNA
—Twisted (PyPI)before 26.4.0rc226.4.0rc2Patch availableGHSA-grgv-6hw6-v9g4
  • twisted Vendortwisted Affected before 26.4.0rc2 Fixed in 26.4.0rc2 Patch available CNA
  • Twisted (PyPI) Vendor— Affected before 26.4.0rc2 Fixed in 26.4.0rc2 Patch available GHSA-grgv-6hw6-v9g4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*before 26.4.0Vulnerabletwisted
cpe:2.3:a:twisted:twisted:26.4.0:rc1:*:*:*:*:*:*26.4.0 rc1Vulnerabletwisted
  • cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* Versions before 26.4.0 Vulnerable ·twisted
  • cpe:2.3:a:twisted:twisted:26.4.0:rc1:*:*:*:*:*:* Versions 26.4.0 rc1 Vulnerable ·twisted

Remediation

  • Fix · CNA twisted (twisted) Fixed in 26.4.0rc2
  • Fix · GHSA-grgv-6hw6-v9g4 Twisted (PyPI) Fixed in 26.4.0rc2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Hardened Images
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42304
  2. 2026-10-03 Alias added: GHSA-grgv-6hw6-v9g4
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Advisory 1

Other 3

  • TI-2022-06090 Buffer Overflow in Twisted CVSS 3.1HIGH 7.5
  • TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
  • TI-2022-18723 Twisted vulnerable to NameVirtualHost Host header injection CVSS 3.1MEDIUM 5.4
  • TI-2020-08165 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2020-08166 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2022-08614 HTTP Request Smuggling in twisted.web CVSS 3.1HIGH 8.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences