CVE catalog

CVE-2026-42304

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhau

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantwistedsid26.4.0-6fixed
Debiantwistedforky26.4.0-6fixed
Debiantwistedtrixie24.11.0-1vulnerable
Debiantwistedbookworm22.4.0-4+deb12u1vulnerable
Debiantwistedbookworm-security22.4.0-4+deb12u1vulnerable
CpetwistedNot reported24.3.0-1ubuntu0.2fixed
Cpepython3-twistedNot reported24.3.0-1ubuntu0.2fixed
Cpetwisted-docNot reported24.3.0-1ubuntu0.2fixed
CpetwistedNot reportedNot reportedvulnerable
CpetwistedNot reported26.4.0fixed
CpetwistedNot reportedNot reportedunknown
PyPItwistedNot reported26.4.0rc2fixed
PyPItwistedNot reported26.4.0fixed
Susepython-Twistedlinux enterprise server 16.024.10.0-160000.3.1fixed
Susepython-Twistedlinux enterprise server for sap applications 16.024.10.0-160000.3.1fixed
Ubuntutwisted22.0420.3.0-7ubuntu1vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.1vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.4vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.5vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.6vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.7fixed
Ubuntutwisted24.0422.4.0-4vulnerable
Ubuntutwisted24.0422.4.0-4ubuntu1vulnerable
Ubuntutwisted24.0423.10.0-2vulnerable
Ubuntutwisted24.0424.3.0-1vulnerable
Ubuntutwisted24.0424.3.0-1ubuntu0.1vulnerable
Ubuntutwisted24.0424.3.0-1ubuntu0.2fixed
Ubuntutwisted25.1024.11.0-1vulnerable
Ubuntutwisted25.1024.11.0-1ubuntu0.1fixed
Ubuntutwisted26.0424.11.0-1vulnerable
Ubuntutwisted26.0425.5.0-4vulnerable
Ubuntutwisted26.0425.5.0-5vulnerable
Ubuntutwisted26.0425.5.0-5ubuntu0.1fixed
Ubuntutwistedpro16.6.0-2ubuntu3vulnerable
Ubuntutwistedpro17.9.0-1vulnerable
Ubuntutwistedpro17.9.0-2vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm2vulnerable
Ubuntutwisted20.0418.9.0-3ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-5vulnerable
Ubuntutwisted20.0418.9.0-6vulnerable
Ubuntutwisted20.0418.9.0-6build1vulnerable
Ubuntutwisted20.0418.9.0-6ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-8vulnerable
Ubuntutwisted20.0418.9.0-11vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.1vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.2vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.3vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.4vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.5vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu1vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.1vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.4vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.5vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.6vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.7fixed
Ubuntutwisted24.0422.4.0-4vulnerable
Ubuntutwisted24.0422.4.0-4ubuntu1vulnerable
Ubuntutwisted24.0423.10.0-2vulnerable
Ubuntutwisted24.0424.3.0-1vulnerable
Ubuntutwisted24.0424.3.0-1ubuntu0.1vulnerable
Ubuntutwisted24.0424.3.0-1ubuntu0.2fixed
Ubuntutwisted25.1024.11.0-1vulnerable
Ubuntutwisted25.1024.11.0-1ubuntu0.1fixed
Ubuntutwisted26.0424.11.0-1vulnerable
Ubuntutwisted26.0425.5.0-4vulnerable
Ubuntutwisted26.0425.5.0-5vulnerable
Ubuntutwisted26.0425.5.0-5ubuntu0.1fixed
Opensusepython-Twistedtumbleweed26.4.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantwistedsourcesid26.4.0-1not yet assignedNot reportedNot reported
Debiantwistedsourceforky26.4.0-1not yet assignedNot reportedNot reported
Debiantwistedsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiantwistedsourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpetwistedcpeNot reported24.3.0-1ubuntu0.2Not reportedNot reportedNot reported
Cpepython3-twistedcpeNot reported24.3.0-1ubuntu0.2Not reportedNot reportedNot reported
Cpetwisted-doccpeNot reported24.3.0-1ubuntu0.2Not reportedNot reportedNot reported
CpetwistedcpeNot reported26.4.0Not reportedNot reportedNot reported
PyPItwistedPyPINot reported26.4.0rc2Not reportedGHSA-GRGV-6HW6-V9G4Not reported
PyPItwistedPyPINot reported26.4.0Not reportedNot reportedNot reported
Susepython-Twistedrpmlinux enterprise server 16.024.10.0-160000.3.1Not reportedSUSE-SU-2026:22004-1Not reported
Susepython-Twistedrpmlinux enterprise server for sap applications 16.024.10.0-160000.3.1Not reportedSUSE-SU-2026:22004-1Not reported
Ubuntutwisteddeb22.0422.1.0-2ubuntu2.7Not reportedUSN-8380-1Not reported
Ubuntutwisteddeb24.0424.3.0-1ubuntu0.2Not reportedUSN-8380-1Not reported
Ubuntutwisteddeb25.1024.11.0-1ubuntu0.1Not reportedUSN-8380-1Not reported
Ubuntutwisteddeb26.0425.5.0-5ubuntu0.1Not reportedUSN-8380-1Not reported
Ubuntutwisteddeb22.0422.1.0-2ubuntu2.7Not reportedUBUNTU-CVE-2026-42304Not reported
Ubuntutwisteddeb24.0424.3.0-1ubuntu0.2Not reportedUBUNTU-CVE-2026-42304Not reported
Ubuntutwisteddeb25.1024.11.0-1ubuntu0.1Not reportedUBUNTU-CVE-2026-42304Not reported
Ubuntutwisteddeb26.0425.5.0-5ubuntu0.1Not reportedUBUNTU-CVE-2026-42304Not reported
Opensusepython-Twistedrpmtumbleweed26.4.0-1.1Not reportedOPENSUSE-SU-2026:10759-1Not reported

Notes

[trixie] twisted: Minor issue [bookworm] twisted: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-twisted]Affected

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

  • [twisted-doc]Affected

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Affected

      nvd · twisted · debian · bookworm; nvd · twisted · debian · 12

[Debian 13 (Trixie)]

  • [python3-twisted]Affected

    Source package: [twisted]

    Details (2)

    • 24.11.0-1 · all · trixie

      Affected

      nvd · twisted · debian · 13

    • 24.11.0-1 · all · trixie

      Affected

      nvd · twisted · debian · 13

  • [twisted-doc]Affected

    Source package: [twisted]

    Details (2)

    • 24.11.0-1 · all · trixie

      Affected

      nvd · twisted · debian · 13

    • 24.11.0-1 · all · trixie

      Affected

      nvd · twisted · debian · 13

[openSUSE Tumbleweed]

  • [python313-Twisted]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-all_non_platform]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-conch]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-conch_nacl]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-contextvars]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-http2]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-serial]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-tls]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-all_non_platform]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-conch]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-conch_nacl]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-contextvars]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-http2]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-serial]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-tls]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 26.4.0-1.1

      Version impact unknown

      nvd · python-Twisted · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]