120 matches found
UBUNTU-CVE-2026-115559
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
CVE-2026-115559
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
AZL-113323 CVE-2026-115559 affecting package python-py 1.11.0-1
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
AZL-113329 CVE-2026-115559 affecting package python3 3.12.16-2
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
EUVD-2026-122790
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
CVE-2026-115559
The imaplib library in Python is vulnerable to a STARTTLS command/response injection (similar to CVE-2011-0411). The IMAP4.starttls() function wraps the socket in TLS but fails to clear the self._readbuf read-ahead buffer. Consequently, plaintext bytes received during the recv() call for the STAR...
CVE-2026-115559
IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...
PT-2026-144403
IMAP4.starttls wraps the socket in TLS but leaves self. readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protect...
Infinite loop
Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Infinite loop via parseNestedParens in twisted/mail/imap4.py when processing an IMAP SEARCH command containing a literal with a negative octet count...
Linux Distros Unpatched Vulnerability : CVE-2026-106454
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translat...
OESA-2026-4428 python-twisted security update
Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...
OESA-2026-4427 python-twisted security update
Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...
OESA-2026-4426 python-twisted security update
Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...
PYSEC-2026-4304 Twisted: IMAP wildcardToRegexp() ReDoS
Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...
Twisted: IMAP wildcardToRegexp() ReDoS
SummarywildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...
SUSE CVE-2026-106454
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...
Twisted: IMAP wildcardToRegexp() ReDoS
Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...
GHSA-8PQF-F4M5-798G Twisted: IMAP wildcardToRegexp() ReDoS
Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...
EUVD-2026-93873
Twisted: IMAP wildcardToRegexp ReDoS...
AZL-106712 CVE-2026-106454 affecting package python-twisted for versions less than 22.10.0-7
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...