Summary
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int() and never rejects a negative value. A negative size such as {-100} drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one SEARCH command holds the reactor at full CPU forever and every other connection stops being served.
Details
Meeting an inline literal, parseNestedParens reads the size between the braces and advances the cursor past the body:
# twisted/mail/imap4.py parseNestedParens
literalSize = int(s[i + 1 : end]) # no sign check
contentStack[-1].append((s[end + 3 : end + 3 + literalSize],))
i = end + 3 + literalSize # negative size -> i goes negative
int(b"-100") is -100, so i goes negative; the loop condition i < len(s) stays true and s[i : i + 1] on a negative index never raises, so the cursor cycles forever. The _literalStringLimit guard only covers the synchronizing-literal continuation path, not this inline branch. The call is reached from select_SEARCH through arg_searchkeys, dispatched only in the selected state, so a valid login and a selected mailbox (any low-privilege account) suffice. It runs in the reactor thread, and the connection timeout cannot fire because the reactor itself is frozen.
Affected product: Twisted (twisted.mail), the IMAP4 server twisted.mail.imap4.IMAP4Server
Affected versions: 26.4.0 and earlier
PoC
Log in, select a mailbox, and send a SEARCH whose literal size is negative:
C: t1 LOGIN testuser password-test
C: t2 SELECT INBOX
C: t3 SEARCH {-100}zzzzzzzzzz
The server never responds and one core stays at 100 percent. In a measured run a health service co-hosted on the same reactor stopped answering the instant the command arrived, showing the freeze hits the whole process and not just the attacking connection. A valid {5}zzzzz completes normally and a non-numeric {abc} is rejected with a parse error, which isolates the cause to the missing negative-size check.
Impact
A remote denial of service. One command of about ten bytes freezes the single-threaded reactor, so it stops serving not only every other IMAP connection but every other service co-hosted in the same process (for example SMTP and POP3 under twistd mail), and no timeout can recover it until the process is restarted. It requires an authenticated session, so any account holder can trigger it; there is no confidentiality or integrity impact and no code execution.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-115774 has a CVSS score of 4.9 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (26.10.0rc1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-115774? CVE-2026-115774 is a medium-severity uncontrolled resource consumption vulnerability in Twisted (pip), affecting versions <= 26.4.0. It is fixed in 26.10.0rc1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-115774? CVE-2026-115774 has a CVSS score of 4.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of Twisted are affected by CVE-2026-115774? Twisted (pip) versions <= 26.4.0 is affected.
- Is there a fix for CVE-2026-115774? Yes. CVE-2026-115774 is fixed in 26.10.0rc1. Upgrade to this version or later.
- Is CVE-2026-115774 exploitable, and should I be worried? Whether CVE-2026-115774 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-115774 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-115774? Upgrade
Twistedto 26.10.0rc1 or later.