Infinite loop in Twisted Web - CVE-2026-115774
Published: November 5, 2026
Vulnerability details
The vulnerability allows an authenticated remote client to cause a process-wide denial of service in Twisted's IMAP4 server with a single small SEARCH command. The resulting infinite loop consumes a CPU core and freezes the single-threaded reactor, stopping all other IMAP connections and services co-hosted on that reactor, including SMTP or POP3. There is no confidentiality or integrity impact and no code execution.
The vulnerability exists due to missing validation of negative inline literal sizes in twisted.mail.imap4.parseNestedParens. The parser converts the size with int() and advances its cursor using that value without rejecting a negative size. A value such as {-100} moves the cursor into negative indices; Python's negative-index slicing does not raise an exception, and the scanning loop cycles indefinitely while its exit condition remains unsatisfied. A remote attacker can log in with any valid account, select a mailbox, and submit a SEARCH command containing such a negative inline literal size to trigger the loop.
The affected component is twisted.mail.imap4.IMAP4Server. SEARCH reaches the parser through select_SEARCH and arg_searchkeys only in the selected state, making authentication and mailbox selection prerequisites. The _literalStringLimit guard covers the synchronizing-literal continuation path but not the vulnerable inline branch. Valid positive literal sizes complete normally, while non-numeric sizes produce a parse error. Parsing runs synchronously in the reactor thread, so connection timeouts cannot fire once the loop freezes the reactor.