twisted 26.10.0rc2

Direct Vulnerabilities

Known vulnerabilities in the twisted package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Regular Expression Denial of Service (ReDoS) Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `wildcardToRegexp` function in `src/twisted/mail/imap4.py`, where user-supplied IMAP mailbox wildcard strings are interpolated directly into a regular expression without escaping non-wildcard characters. An authenticated attacker can supply a mailbox name containing regex metacharacters to cause catastrophic backtracking, crashing the IMAP server process. How to fix Regular Expression Denial of Service (ReDoS)? A fix was pushed into the `master` branch but not yet published.	[0,)
M Arbitrary Command Injection Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Arbitrary Command Injection via improper input sanitization in the file upload process. An attacker can execute arbitrary commands on the target system by sending a specially crafted HTTP PUT request to upload a malicious file and subsequently triggering its execution. This can result in remote code execution and potential privilege escalation depending on the web server's permissions. How to fix Arbitrary Command Injection? There is no fixed version for `Twisted`.	[0,)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

Twisted is an event-based network programming and multi-protocol integration framework.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the wildcardToRegexp function in src/twisted/mail/imap4.py, where user-supplied IMAP mailbox wildcard strings are interpolated directly into a regular expression without escaping non-wildcard characters. An authenticated attacker can supply a mailbox name containing regex metacharacters to cause catastrophic backtracking, crashing the IMAP server process.

How to fix Regular Expression Denial of Service (ReDoS)?

A fix was pushed into the master branch but not yet published.

[0,)

Arbitrary Command Injection

Twisted is an event-based network programming and multi-protocol integration framework.

Affected versions of this package are vulnerable to Arbitrary Command Injection via improper input sanitization in the file upload process. An attacker can execute arbitrary commands on the target system by sending a specially crafted HTTP PUT request to upload a malicious file and subsequently triggering its execution. This can result in remote code execution and potential privilege escalation depending on the web server's permissions.

How to fix Arbitrary Command Injection?

There is no fixed version for Twisted.

[0,)

twisted@26.10.0rc2

An asynchronous networking framework written in Python

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically