CVE-2026-83813

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description In the twisted.names.dns.DNSDatagramProtocol, the system accepts UDP DNS responses for pending queries based solely on a matching 16-bit transaction ID without verifying the source host and port. An attacker who can send a packet to the resolver's listening port with the correct transaction ID can inject forged answers. While the twisted.names.client.Resolver uses random source ports to increase attack complexity, applications reusing a DNSDatagramProtocol instance are more susceptible. Successful exploitation can lead to redirected hostname resolution, mail interception, server-side request forgery, or man-in-the-middle positioning.

Recommendations Update to version 26.10.0rc1.