CVE-2026-42304

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42304", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T12:13:55.552Z", "datePublished": "2026-05-13T20:20:29.149Z", "dateUpdated": "2026-05-14T15:45:34.746Z"}, "containers": {"cna": {"title": "Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"}], "affected": [{"vendor": "twisted", "product": "twisted", "versions": [{"version": "< 26.4.0rc2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T20:20:29.149Z"}, "descriptions": [{"lang": "en", "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2."}], "source": {"advisory": "GHSA-grgv-6hw6-v9g4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T15:44:57.486318Z", "id": "CVE-2026-42304", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:45:34.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains", "source": {"advisory": "GHSA-grgv-6hw6-v9g4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "twisted", "product": "twisted", "versions": [{"status": "affected", "version": "< 26.4.0rc2"}]}], "references": [{"url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "name": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T20:20:29.149Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42304", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:44:57.486318Z"}}}], "references": [{"url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-14T15:45:21.220Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-42304", "state": "PUBLISHED", "dateUpdated": "2026-05-13T20:20:29.149Z", "dateReserved": "2026-04-26T12:13:55.552Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-13T20:20:29.149Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "twisted", "vendor": "twisted", "versions": [{"status": "affected", "version": "< 26.4.0rc2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD1B0989-189E-4EDA-AE20-1899AC64A020", "versionEndExcluding": "26.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:twisted:twisted:26.4.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "2B480C5D-4E35-4F9F-95F8-00F906919315", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2."}, {"lang": "es", "value": "Twisted es un framework basado en eventos para aplicaciones de internet, compatible con Python 3.6+. Antes de 26.4.0rc2, el m\u00f3dulo twisted.names es vulnerable a un ataque de denegaci\u00f3n de servicio (DoS) a trav\u00e9s del agotamiento de recursos durante la descompresi\u00f3n de nombres DNS. Un atacante remoto no autenticado puede explotar esto enviando un paquete DNS TCP manipulado que contiene punteros de compresi\u00f3n profundamente encadenados. Esta falla omite la l\u00f3gica de prevenci\u00f3n de bucles anterior, lo que provoca que el reactor Twisted de un solo hilo se cuelgue mientras procesa millones de b\u00fasquedas recursivas, congelando efectivamente el servidor. Esta vulnerabilidad se corrige en 26.4.0rc2."}], "id": "CVE-2026-42304", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42304", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T15:44:57.486318Z", "version": "2.0.3"}}]}, "published": "2026-05-13T21:16:46.933", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.4.0rc2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "twisted", "source": "cna", "vendor": "twisted"}, "product": "twisted", "vendor": "twisted"}], "created": "2026-05-13T21:45:05.331269+00:00", "updated": "2026-05-13T22:30:05.760708+00:00", "vendors": ["twisted", "twisted$PRODUCT$twisted"]}