Summary
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The twistd words server inherits the method unchanged through IRCUser, and the data is buffered before any authentication.
Details
IRC.dataReceived keeps everything up to the last line feed in self.buffer:
# twisted/words/protocols/irc.py
class IRC(protocol.Protocol): # not a LineReceiver, so no MAX_LENGTH
buffer = ""
def dataReceived(self, data):
if isinstance(data, bytes):
data = data.decode("utf-8")
lines = (self.buffer + data).split(LF)
self.buffer = lines.pop() # no 3line feed -> whole input stays buffered
...
With no line feed in the data, lines.pop() returns the entire accumulated content to self.buffer, so it grows by every chunk and is never bounded; IRC defines no MAX_LENGTH, no lineLengthExceeded, and no timeout, so the connection is never closed. The twistd words server protocol IRCUser subclasses IRC without overriding dataReceived, and the buffer is filled before any PASS, NICK, or USER, so no credentials are required.
Affected product: Twisted (twisted.words), twisted.words.protocols.irc.IRC and its subclass twisted.words.service.IRCUser
Affected versions: 26.4.0 and earlier
PoC
On a standard Twisted words IRC server (the server twistd words runs, using IRCUser), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.
In a measured run against a real IRCFactory server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.
Impact
An unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole twistd words process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-115776 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (26.10.0rc1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-115776? CVE-2026-115776 is a high-severity uncontrolled resource consumption vulnerability in Twisted (pip), affecting versions <= 26.4.0. It is fixed in 26.10.0rc1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-115776? CVE-2026-115776 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of Twisted are affected by CVE-2026-115776? Twisted (pip) versions <= 26.4.0 is affected.
- Is there a fix for CVE-2026-115776? Yes. CVE-2026-115776 is fixed in 26.10.0rc1. Upgrade to this version or later.
- Is CVE-2026-115776 exploitable, and should I be worried? Whether CVE-2026-115776 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-115776 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-115776? Upgrade
Twistedto 26.10.0rc1 or later.