Origin validation error in Twisted Web - CVE-2026-83813
Published: November 5, 2026
Vulnerability details
The vulnerability allows forged DNS answers and DNS cache poisoning in applications using Twisted's DNS client, redirecting hostname resolution to attacker-chosen addresses. Successful exploitation can enable mail interception through forged MX or A records, server-side request forgery, or man-in-the-middle positioning against applications that trust the resolved address.
The vulnerability exists due to missing response source-address validation in twisted.names.dns.DNSDatagramProtocol.datagramReceived in src/twisted/names/dns.py. Responses are accepted for pending queries solely when their 16-bit transaction ID matches an entry in liveMessages; the supplied UDP source address is not compared with the queried server's address. The UDP socket is not connected to that server, so the kernel does not filter unrelated senders either. A remote attacker can send a forged DNS response from an unrelated address to the resolver's listening port and satisfy a pending query if the packet carries the correct transaction ID and arrives before the query completes or times out.
The transaction ID is generated using secure randomness, but its space is only 65,536 possibilities. The standard twisted.names.client.Resolver creates a new protocol instance and independently randomized source port for each query, then closes the socket when the query completes, requiring an off-path attacker to guess roughly 32 combined bits of port and transaction ID within the query timeout. Direct use of the public DNSDatagramProtocol class across multiple queries on one instance instead reuses the listening port; once that port is known, subsequent queries require guessing only the 16-bit transaction ID. An on-path attacker, an attacker sharing a broadcast domain or NAT with the resolver or DNS server, or another party able to observe or narrow the ephemeral port faces a reduced guessing barrier and no additional source-address check. The same acceptance logic affects createResolver and consumers of the standard resolver, including MX lookups in twisted.mail.