Allocation of Resources Without Limits or Throttling in Twisted Web - CVE-2026-115776
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote client to exhaust the memory of a Twisted words IRC server and cause a denial of service for all users. A single connection can drive the entire single-threaded server process out of memory, dropping all connections and leaving the service unavailable until restarted. There is no confidentiality or integrity impact and no code execution.
The vulnerability exists due to unbounded accumulation of incomplete IRC lines in twisted.words.protocols.irc.IRC.dataReceived. Received data is concatenated with self.buffer and split at line feeds; the remaining incomplete line is retained without a maximum length. A remote attacker can open a single TCP connection to the IRC server and continuously send data containing no line feed, causing every chunk to remain buffered without completing a command. Buffering occurs before authentication or processing of PASS, NICK, or USER, so no credentials are required. The protocol has no line-length limit, overlength handler, or timeout to close this connection, and quadratic buffer copying accelerates resource exhaustion.
The affected component is Twisted's twisted.words IRC server, rather than its web server. The IRC class in twisted/words/protocols/irc.py derives directly from Protocol, not LineReceiver, and therefore does not inherit its line-length enforcement. The twisted.words.service.IRCUser subclass used by twistd words inherits the vulnerable method unchanged. In a measured test, 60 MB of line-feed-free input on one unauthenticated connection increased server resident memory from approximately 47 MB to 2966 MB without closing the connection or triggering a limit; the same volume of line-feed-terminated commands left memory usage flat.