---
id: CVE-2026-115774
title: >-
  Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal
  Size in SEARCH
summary: >-
  Twisted is an event-based framework for internet applications, supporting
  Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches
  twisted.mail.imap4.parseNestedParens with a negative literal size in an
  authenticated SEAR…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-835
vendor: twisted
product: twisted
affected:
  - twisted < 26.10.0rc1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T14:19:46.890332Z'
exploitAvailable: true
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T14:20:15.738Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115774'
references:
  - url: 'https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v'
    label: 'https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v'
  - url: 'https://github.com/twisted/twisted/pull/12764'
    label: 'https://github.com/twisted/twisted/pull/12764'
  - url: >-
      https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741
    label: >-
      https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741
  - url: 'https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1'
    label: 'https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1'
  - url: 'https://github.com/twisted/twisted'
  - url: 'https://github.com/advisories/GHSA-2qrf-pqgx-qh9v'
tags:
  - cve.org
  - exploit-available
  - osv
  - pip
  - ghsa
epss: 0.0052
epssPercentile: 0.44327
aliases:
  - GHSA-2qrf-pqgx-qh9v
ecosystem: pip
patched:
  - twisted 26.10.0rc1
ingestedAt: '2026-10-23T20:36:51.531Z'
---

## Overview

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

## Affected

- `twisted < 26.10.0rc1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115774)

Affected packages:

- `twisted < 26.10.0rc1`

Patched in:

- `twisted 26.10.0rc1`

Source: https://osv.dev/vulnerability/GHSA-2qrf-pqgx-qh9v