Zero Radar
← feed
HighVulnerabilityCVE-2026-115775updated 25 Oct 2026, 13:32 UTC

Twisted XML parser can be made to use unlimited memory by a remote peer

A remote client can keep an XML document open and keep adding pieces to it without ever closing it. The server keeps everything in memory until it runs out and crashes.

Fixed in Twisted 26.10.0rc1Official, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesTwisted 26.10.0rc1 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote peerNo login needed to connect
  2. 2Open XML streamSends container element, never closes it
  3. 3Stream childrenKeeps adding child elements continuously
  4. 4Memory growsParser keeps every element with no limit
  5. ResultServer runs out of memory and crashes

What happened

In Twisted's twisted.words.xish.domish ExpatElementStream, a container element can stay open while unlimited child elements are appended to an in-memory tree, with no depth, count, or byte limit. Elements are only released when their end tag arrives.

Why it is dangerous: A single unauthenticated connection can exhaust server memory and terminate the process, causing denial of service. Servers parsing untrusted XML streams, such as XMPP servers, are at risk.

Are you affected?

You are affected if you run Twisted 26.4.0 or earlier with twisted.words.xish.domish parsing untrusted XML streams, for example an XMPP server or component.

Package / productAffected versionsFixed in
Twisted · pip<= 26.4.026.10.0rc1

What to do

  1. Update Twisted to 26.10.0rc1 or later
  2. If you cannot update yet, restrict which clients can open XMPP or XML streams to your server
  3. Monitor server memory use for unusual growth from single connections

Timeline

  1. 23 Oct 2026, 20:45 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:45 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 23 Oct 2026, 21:17 UTC
    Reported by NVD · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115775 · GHSA-3476-c5c2-fr73
CVSS
8.7 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:45 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Twisted XML parser can be made to use unlimited memory by a remote peer · Zero Radar