Inefficient Algorithmic Complexity in Twisted Web - CVE-2026-42304

Vulnerability identifier: #VU128497

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2026-42304

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Twisted Web
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
Python 3 Module
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
twisted (Ubuntu package)
python3-Twisted
python-Twisted-doc
python-twisted
python3-twisted
python-twisted-help
python311-Twisted-contextvars
python311-Twisted-conch_nacl
python311-Twisted-all_non_platform
python311-Twisted-serial
python311-Twisted-tls
python311-Twisted-conch
python311-Twisted-http2
python311-Twisted

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in twisted.names.dns.Name.decode when processing crafted TCP DNS packets with deeply chained compression pointers. A remote attacker can send a specially crafted TCP DNS packet to cause a denial of service.

A single malformed packet can block the single-threaded Twisted reactor event loop for several seconds, preventing the server from handling new connections, processing I/O, or responding to existing requests.

Install security update from vendor's website.

• https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4
• https://github.com/advisories/GHSA-grgv-6hw6-v9g4
• https://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09