CVE-2026-115774

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command after the client has entered the selected mailbox state. This negative size causes the parser cursor to move below zero, which, combined with Python's negative indexing, prevents the synchronous scanning loop from terminating. This results in an infinite loop that freezes the single-threaded reactor, effectively causing a denial of service by stopping all other IMAP connections and any SMTP or POP3 services hosted within the same process until the system is restarted.

Recommendations Update to version 26.10.0rc1.