Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-106454 EUVD-2026-93873GHSA-8pqf-f4m5-798gPYSEC-2026-4304

Twisted: IMAP wildcardToRegexp() ReDoS

Published Oct 6, 2026 · Updated Oct 7, 2026 · Assigned by GitHub_M

Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
twisted twisted <= 25.5.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 twisted 26.4.0-5 —
Debian 13 twisted No fix yet —
Debian 12 twisted No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 twisted 26.4.0-4ubuntu0.1 USN-9000-1
Ubuntu 26.04 LTS twisted 25.5.0-5ubuntu0.2 USN-9000-1
Ubuntu 24.04 LTS twisted 24.3.0-1ubuntu0.3 USN-9000-1
Ubuntu 22.04 LTS twisted 22.1.0-2ubuntu2.8 USN-9000-1
Ubuntu 20.04 LTS twisted No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS twisted No fix yet —
Ubuntu Pro 16.04 LTS twisted No fix yet —
Ubuntu Pro 14.04 LTS twisted No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP6 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLES 15 SP5 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLES 15 SP4 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLES 3 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLES for SAP 15 SP5 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLES for SAP 15 SP4 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLE HPC 15 SP5 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
SLE HPC 15 SP4 python-Twisted 22.10.0-150400.5.31.1 SUSE-SU-2026:5215-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-Twisted 26.4.0-4.1 openSUSE-SU-2026:12137-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-twisted 22.10.0-7 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI twisted <= 26.4.0 — GHSA-8pqf-f4m5-798g
PyPI twisted <= 25.5.0 — PYSEC-2026-4304

Advisories 3

References