Infinite loop Affecting twisted package, versions [,26.10.0rc1)

Twisted is an event-based network programming and multi-protocol integration framework.

Affected versions of this package are vulnerable to Infinite loop via parseNestedParens in twisted/mail/imap4.py when processing an IMAP SEARCH command containing a literal with a negative octet count. An authenticated client can send a command such as SEARCH {-100} which causes the function to enter an infinite loop, freezing the entire reactor and preventing the server from handling any further requests.

Note: This is only exploitable by an authenticated IMAP client.

Log in, select a mailbox, and send a SEARCH whose literal size is negative:

C: t1 LOGIN testuser password-test
C: t2 SELECT INBOX
C: t3 SEARCH {-100}zzzzzzzzzz

The server never responds and one core stays at 100 percent. In a measured run a health service co-hosted on the same reactor stopped answering the instant the command arrived, showing the freeze hits the whole process and not just the attacking connection. A valid {5}zzzzz completes normally and a non-numeric {abc} is rejected with a parse error, which isolates the cause to the missing negative-size check.

Note: The PoC states no specific environment, operating system, or non-default configuration.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release