Zero Radar
← feed
HighVulnerabilityCVE-2026-115776updated 25 Oct 2026, 13:32 UTC

Twisted IRC server can be crashed by one connection sending endless data

Someone can connect to the Twisted IRC chat server without logging in and send data that never ends a line. The server keeps all of it in memory until it runs out, which crashes the whole server and disconnects everyone.

Fixed in Twisted 26.10.0rc1Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesTwisted 26.10.0rc1 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated clientNo login or credentials needed
  2. 2Connects over TCPSingle connection to the IRC port
  3. 3Server buffers all dataNo line feed, so nothing is consumed
  4. 4Memory grows unboundedProcess memory climbs until exhausted
  5. ResultServer crashes, all users disconnected

What happened

twisted.words IRC.dataReceived buffers all received bytes without a line feed and applies no maximum line length, causing unbounded memory growth before authentication.

Why it is dangerous: A single unauthenticated remote connection can exhaust memory of the whole twistd words process, taking down the service for all users until it is restarted.

Are you affected?

You are affected if you run Twisted 26.4.0 or earlier with the twisted.words IRC server (for example via 'twistd words') exposed to the network.

Package / productAffected versionsFixed in
Twisted · pip<= 26.4.026.10.0rc1

What to do

  1. Upgrade Twisted to 26.10.0rc1 or later (pip install 'Twisted>=26.10.0rc1')
  2. If you cannot upgrade yet, do not expose the twistd words IRC server to untrusted networks
  3. Restart the service after upgrading and confirm the new version is running

Timeline

  1. 23 Oct 2026, 20:45 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:45 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 23 Oct 2026, 21:17 UTC
    Reported by NVD · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115776 · GHSA-53xc-49m8-p798
CVSS
7.5 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:45 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Twisted IRC server can be crashed by one connection sending endless data · Zero Radar