CVE-2026-115776

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description An unbounded-buffer issue exists in the Twisted words IRC server where the dataReceived() function in twisted.words.protocols.irc.IRC appends all received bytes to a per-connection buffer without enforcing a maximum line length. Because the IRC class is a plain Protocol and not a LineReceiver, it lacks a MAX LENGTH limit. The twisted.words.service.IRCUser server subclass inherits this behavior, allowing buffering to occur before PASS, NICK, or USER authentication commands are processed. An unauthenticated remote client can continuously stream data without a line feed, causing the buffer to grow without bound. This leads to uncontrolled resource consumption, potentially exhausting the memory of the single-threaded server process and resulting in a denial of service that drops all connected users.

Recommendations Update Twisted to version 26.10.0rc1 or later.