Zero Radar
← feed
HighVulnerabilityCVE-2026-115778updated 25 Oct 2026, 13:32 UTC

Twisted telnet server can be crashed by unauthenticated memory exhaustion

Anyone who can connect to a Twisted telnet service can send data that never ends its command, so the server keeps storing it in memory until it runs out and crashes, taking down other services on that server too.

Fixed in Twisted 26.10.0rc1Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesTwisted 26.10.0rc1 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker connectsNo login needed, telnet opens before auth
  2. 2Sends IAC SBStarts a subnegotiation command
  3. 3Streams bytes foreverNever sends the IAC SE terminator
  4. 4Buffer grows unboundedEvery byte stored in memory, no limit
  5. ResultServer runs out of memory and crashes

What happened

twisted.conch.telnet.Telnet.dataReceived appends every byte after IAC SB to a per-connection buffer with no maximum length; the buffer is only released on IAC SE, which an attacker can withhold (CWE-770).

Why it is dangerous: An unauthenticated remote attacker can exhaust server memory over one connection, causing a denial of service for the whole process and every service it hosts. No data is stolen and no code is run.

Are you affected?

You are affected if you run Twisted 26.4.0 or earlier with the conch telnet transport (for example the telnet manhole service) exposed to untrusted network peers.

Package / productAffected versionsFixed in
Twisted · pip<= 26.4.026.10.0rc1

What to do

  1. Upgrade Twisted to 26.10.0rc1 or later (pip install --upgrade 'Twisted>=26.10.0rc1').
  2. Until patched, do not expose the Twisted telnet or manhole service to untrusted networks; restrict access with a firewall or bind to localhost.
  3. Monitor server memory use for unusual growth on telnet-enabled services.

Timeline

  1. 23 Oct 2026, 20:45 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:45 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 23 Oct 2026, 21:17 UTC
    Reported by NVD · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115778 · GHSA-cwm5-jh59-mwxr
CVSS
7.5 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 20:45 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Twisted telnet server can be crashed by unauthenticated memory exhaustion · Zero Radar