DNS response spoofing in Twisted names lacks source address checks
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.
Summary
Twisted before 26.10.0rc1 accepts a UDP DNS response in twisted.names.dns.DNSDatagramProtocol when its 16-bit transaction ID matches, without checking the sender host and port. This origin validation error (CWE-346) lets forged answers enter the resolver. An attacker who can reach the resolver's listening port with the correct transaction ID can inject a forged answer that redirects hostname resolution.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| twisted | twisted | before 26.7.0rc1 | 26.7.0rc1 | Patch available | CNA |
| — | Twisted (PyPI) | before 26.10.0rc1 | 26.10.0rc1 | Patch available | GHSA-jj36-9pvh-vj5r |
- twisted Vendortwisted Affected before 26.7.0rc1 Fixed in 26.7.0rc1 Patch available CNA
- Twisted (PyPI) Vendor— Affected before 26.10.0rc1 Fixed in 26.10.0rc1 Patch available GHSA-jj36-9pvh-vj5r
Remediation
Upgrade Twisted to version 26.10.0rc1, which the source names as the fixed version. The sources also list 26.7.0rc1 as a fixed version for the twisted product. Red Hat lists Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 6 and Red Hat OpenStack Platform 13 (Queens) as affected without a fix and with no plan available, and Red Hat OpenStack Platform 16.2 as affected with no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA twisted (twisted) Fixed in 26.7.0rc1
- Fix · GHSA-jj36-9pvh-vj5r Twisted (PyPI) Fixed in 26.10.0rc1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-23 Threatist record created from CVE-2026-83813
- 2026-10-24 Affected versions changed · Red Hat
- 2026-10-24 CVSS score added · Red Hat
- 2026-10-27 Alias added: GHSA-jj36-9pvh-vj5r
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: LOW → MEDIUM
- 2026-11-07 Affected versions changed · Red Hat
References
Other 5
- https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
- https://github.com/twisted/twisted/pull/12700
- https://github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
- https://github.com/twisted/twisted
More twisted vulnerabilities
- TI-2026-79985 Unauthenticated memory exhaustion in Twisted domish XML parser CVSS 4.0HIGH 8.7
- TI-2026-30612 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains CVSS 3.1HIGH 7.5
- TI-2022-06090 Buffer Overflow in Twisted CVSS 3.1HIGH 7.5
- TI-2024-27732 twisted.web has disordered HTTP pipeline response CVSS 3.1HIGH 8.3
- TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
- TI-2026-79989 HTTP request smuggling in Twisted web via bare CR or LF in headers CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-83813 · CVE Program
- CVE-2026-83813 · NVD
- FIRST EPSS
- GHSA-jj36-9pvh-vj5r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-83813 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences