Allocation of Resources Without Limits or Throttling in Twisted Web - CVE-2026-115778
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote peer to exhaust server memory through a single connection to an exposed Twisted conch Telnet transport, causing denial of service. Unbounded memory growth can cause the operating system to kill the server process, disrupting every service it hosts. There is no confidentiality or integrity impact and no code execution.
The vulnerability exists due to an unbounded per-connection subnegotiation buffer in Telnet.dataReceived in src/twisted/conch/telnet.py. Receiving IAC SB enters the subnegotiation state and initializes a command list; each subsequent non-IAC byte is appended without a length check. The list persists across reads and is deleted only when IAC SE completes the subnegotiation. A remote attacker can connect to an endpoint exposing this transport, send IAC SB (0xFF 0xFA), and continuously stream non-0xFF bytes while withholding IAC SE (0xFF 0xF0), making the buffer grow for the life of the connection.
The affected surface includes exposed Twisted Telnet endpoints such as the manhole Telnet service. Option negotiation occurs before authentication, so no credentials are required. Negotiation bytes are consumed inside Telnet.dataReceived before application callbacks, preventing the application from imposing a buffer bound. Each byte is retained as a separate list element, amplifying memory consumption through per-byte overhead; a modest-bandwidth peer using one connection, or several such connections, can therefore drive the process to memory exhaustion.