CVE-2026-115778

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description An unauthenticated remote peer can cause memory exhaustion leading to a denial of service. The issue occurs in the twisted.conch.telnet.Telnet.dataReceived() function, which appends bytes received after an IAC SB sequence to a persistent subnegotiation buffer without a maximum length limit until an IAC SE sequence is received. Since Telnet option negotiation happens before authentication, an attacker can omit the terminator to continuously grow the buffer, potentially terminating the process and all hosted services.

Recommendations Update to version 26.10.0rc1.