Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialise...

CVE-2026-115775 Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains t...

CVE-2026-115775

The Twisted event-based framework (Python 3.6+) is vulnerable to an unauthenticated Remote Denial of Service in the twisted.words.xish.domish ExpatElementStream parser. Prior to version 26.10.0rc1 , an attacker can keep a container element open and continuously add child elements. Because the par...