Summary
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.
Details
In ExpatElementStream._onStartElement, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:
# src/twisted/words/xish/domish.py (ExpatElementStream._onStartElement)
if self.documentStarted == 1:
if self.currElem != None:
self.currElem.children.append(e) # append child: no depth/count cap
e.parent = self.currElem
self.currElem = e # descend into the new element
An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport XmlStream.dataReceived feeds bytes to self.stream.parse(data) with no size limit, and in XMPP the stream is parsed during negotiation before authentication.
Affected product: Twisted, twisted.words.xish.domish element stream
Affected versions: confirmed against 26.4.0
PoC
On any endpoint that parses untrusted XML streams with this stack, such as an XMPP server, open a stream by sending the opening stream:stream tag and a container element, then stream child elements continuously and never send the container's closing tag. No credentials are required, because in XMPP the stream is parsed before authentication.
Every child is appended to the container and retained because the container is never emitted, and the transport applies no limit on the size of the unfinished document. Because each small element becomes a full object in memory the footprint is many times the traffic sent, so a modest-bandwidth peer, or several such streams, drives the process to memory exhaustion.
Impact
This is an unauthenticated remote denial of service by memory exhaustion. A single stream grows an in-memory element tree without bound, amplified by per-element object overhead, until the operating system kills the server. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that parses untrusted XML streams with this stack, such as an XMPP server or component.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-115775? CVE-2026-115775 is a high-severity uncontrolled resource consumption vulnerability in Twisted (pip), affecting versions <= 26.4.0. It is fixed in 26.10.0rc1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- Which versions of Twisted are affected by CVE-2026-115775? Twisted (pip) versions <= 26.4.0 is affected.
- Is there a fix for CVE-2026-115775? Yes. CVE-2026-115775 is fixed in 26.10.0rc1. Upgrade to this version or later.
- Is CVE-2026-115775 exploitable, and should I be worried? Whether CVE-2026-115775 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-115775 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-115775? Upgrade
Twistedto 26.10.0rc1 or later.