CVE-2026-115775

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description The twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. Because the parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing occurs before credentials are accepted, a single connection can exhaust server memory and terminate the process, leading to a denial of service.

Recommendations Update to version 26.10.0rc1.