Allocation of Resources Without Limits or Throttling in Twisted Web - CVE-2026-115775
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote peer to exhaust server memory and cause denial of service in deployments that parse untrusted XML streams using Twisted's domish element stream, such as XMPP servers or components. A single stream can grow an in-memory element tree without bound until the operating system kills the server process. Per-element object overhead amplifies memory consumption relative to the traffic sent, allowing modest-bandwidth traffic or several concurrent streams to exhaust memory. There is no confidentiality or integrity impact and no code execution.
The vulnerability exists due to unrestricted allocation and retention of XML elements without limits on tree depth, child count, or unfinished document size. A remote attacker can connect to an endpoint using this XML stream stack, send an opening stream tag and a container element, then continuously send child elements without closing the container. Each child remains attached to the unfinished container, including children whose own end tags have arrived, so memory consumption continues to grow.
In src/twisted/words/xish/domish.py, ExpatElementStream._onStartElement appends each new element to the current element's children and descends into it without checking depth or child count. An element is emitted and dropped only when its end tag arrives while it sits directly beneath the document root; leaving that container open retains its entire subtree. The transport's XmlStream.dataReceived passes incoming bytes to self.stream.parse(data) without a size limit. In XMPP, this parsing occurs during negotiation before authentication, so credentials are not required.