Skip to content
OpenAdvisories
Medium USN-9000-1 1 CVE

twisted vulnerability

Published Nov 4, 2026 · Updated Nov 5, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Twisted's IMAP server mishandled wildcard
patterns in mailbox list commands. An authenticated remote attacker
could possibly use this issue to cause Twisted to use excessive
resources, leading to a denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS twisted 22.1.0-2ubuntu2.8
Ubuntu · 24.04 LTS 24.04:LTS twisted 24.3.0-1ubuntu0.3
Ubuntu · 26.04 LTS 26.04:LTS twisted 25.5.0-5ubuntu0.2
Ubuntu · 26.10 twisted 26.4.0-4ubuntu0.1

Vulnerabilities 1

  • Medium 4.3
    CVE-2026-106454

    Twisted: IMAP wildcardToRegexp() ReDoS

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated …

    twisted twisted twisted twisted Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-106454