{"cve":"CVE-2026-115774","nvd":{"published":"2026-10-23T21:17:22.900","modified":"2026-10-23T21:17:22.900","status":"Received","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9},"cwes":["CWE-400","CWE-835"],"references":["https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741","https://github.com/twisted/twisted/pull/12764","https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1","https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-115774","score":0.0043,"percentile":0.37001,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-2qrf-pqgx-qh9v","url":"https://osv.dev/vulnerability/GHSA-2qrf-pqgx-qh9v","summary":"Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH","modified":"2026-10-23T21:00:04.322993195Z","packages":[{"ecosystem":"PyPI","name":"twisted","purl":"pkg:pypi/twisted","ranges":["<26.10.0rc1"],"fixed":["26.10.0rc1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}