{"schema":"threatline.record/2","record":{"id":"CVE-2026-115774","aliases":["GHSA-2qrf-pqgx-qh9v"],"summary":"Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH","details":"## Summary\n\nAn infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served.\n\n## Details\n\nMeeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body:\n\n```python\n# twisted/mail/imap4.py  parseNestedParens\nliteralSize = int(s[i + 1 : end])          # no sign check\ncontentStack[-1].append((s[end + 3 : end + 3 + literalSize],))\ni = end + 3 + literalSize                    # negative size -> i goes negative\n```\n\n`int(b\"-100\")` is `-100`, so `i` goes negative; the loop condition `i < len(s)` stays true and `s[i : i + 1]` on a negative index never raises, so the cursor cycles forever. The `_literalStringLimit` guard only covers the synchronizing-literal continuation path, not this inline branch. The call is reached from `select_SEARCH` through `arg_searchkeys`, dispatched only in the selected state, so a valid login and a selected mailbox (any low-privilege account) suffice. It runs in the reactor thread, and the connection timeout cannot fire because the reactor itself is frozen.\n\nAffected product: Twisted (`twisted.mail`), the IMAP4 server `twisted.mail.imap4.IMAP4Server`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nLog in, select a mailbox, and send a `SEARCH` whose literal size is negative:\n\n```text\nC: t1 LOGIN testuser password-test\nC: t2 SELECT INBOX\nC: t3 SEARCH {-100}zzzzzzzzzz\n```\n\nThe server never responds and one core stays at 100 percent. In a measured run a health service co-hosted on the same reactor stopped answering the instant the command arrived, showing the freeze hits the whole process and not just the attacking connection. A valid `{5}zzzzz` completes normally and a non-numeric `{abc}` is rejected with a parse error, which isolates the cause to the missing negative-size check.\n\n## Impact\n\nA remote denial of service. One command of about ten bytes freezes the single-threaded reactor, so it stops serving not only every other IMAP connection but every other service co-hosted in the same process (for example SMTP and POP3 under `twistd mail`), and no timeout can recover it until the process is restarted. It requires an authenticated session, so any account holder can trigger it; there is no confidentiality or integrity impact and no code execution.","categories":["Libraries & packages"],"product":"Twisted","vendor":"twisted","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","source_modified_at":"2026-10-23T20:46:13Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"pip","name":"Twisted"},"range":"<= 26.4.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115774","source_modified_at":"2026-10-23T20:14:07.480Z","fetched_at":"2026-10-23T20:37:03.234832Z","product":"twisted","vendor":"twisted","versions":[{"status":"affected","version":"< 26.10.0rc1"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2qrf-pqgx-qh9v","source_modified_at":"2026-10-23T21:00:04.322993195Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"name":"twisted","ecosystem":"PyPI","purl":"pkg:pypi/twisted"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.10.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","source_modified_at":"2026-10-23T20:46:13Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"pip","name":"Twisted"},"version":"26.10.0rc1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2qrf-pqgx-qh9v","source_modified_at":"2026-10-23T21:00:04.322993195Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"name":"twisted","ecosystem":"PyPI","purl":"pkg:pypi/twisted"},"version":"26.10.0rc1"}],"cvss":4.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T20:14:07.480Z","modified_at":"2026-10-23T21:00:04.322993195Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-23T20:46:13Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115774","fetched_at":"2026-10-23T20:37:03.234832Z","source_modified_at":"2026-10-23T20:14:07.480Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-2qrf-pqgx-qh9v","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-23T21:00:04.322993195Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/twisted/twisted/pull/12764","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T21:00:04.322993195Z","content_hash":"c6a537c5a61132041cf0302cca7596d21129e8d5d861917a156a2056ab160c35"}}