CVE-2026-42304

Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

State: Published
Severity: 7.5 High
Published: May 13, 2026
Updated: May 14, 2026
Reserved: Apr 26, 2026

Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-407 Inefficient Algorithmic Complexity

Affected Products

Product	Versions
twistedtwisted	< 26.4.0rc2Affected

References

https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.