---
id: "CVE-2026-115775"
kind: "vulnerability"
aliases: ["CVE-2026-115775", "GHSA-3476-c5c2-fr73"]
title: "Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Twisted", "fixed": ["26.10.0rc1"], "affected": "<= 26.4.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-400", "cwe-770", "package", "python", "self-hosted", "twisted", "xmpp"]
not_affected_if: ["managed-hosting", "no-twisted-words-usage"]
published_at: "2026-10-23T20:45:04+00:00"
first_seen_at: "2026-10-23T20:45:22+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-3476-c5c2-fr73", "first_seen_at": "2026-10-23T20:45:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115775", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted's words domish XML stream keeps every child element of a container that is never closed, so memory grows without limit. An unauthenticated peer on an XMPP or other XML stream endpoint can exhaust server memory and crash the process, a denial of service with no code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:Twisted affected <= 26.4.0 fixed 26.10.0rc1

## How to check

Run pip show twisted and confirm the version is 26.4.0 or lower.
Find whether the app parses XML streams with twisted.words (XMPP server or component) by searching for 'twisted.words' in the codebase.

## Fix

Upgrade Twisted to 26.10.0rc1 or later (pip install -U 'twisted>=26.10.0rc1').

## Timeline

- 2026-10-23T20:45:22+00:00 ghsa https://github.com/advisories/GHSA-3476-c5c2-fr73
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115775

## From the sources

## Summary

An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.

## Details

In `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:

```python
# src/twisted/words/xish/domish.py  (ExpatElementStream._onStartElement)
if self.documentStarted == 1:
    if self.currElem != None:
        self.currElem.children.append(e)   # append child: no depth/count cap
        e.parent = self.currElem
    self.currElem = e                      # descend into the new element
```

An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport `XmlStream.dataReceived` feeds bytes to `self.stream.parse(data)` with no size limit, and in XMPP the stream is parsed during negotiation before authentication.

Affected product: Twisted, `twisted.words.xish.domish` element stream
Affected versions: confirmed against 26.4.0

## PoC

On any endpoint that parses untrusted XML streams with this stack, such as an XMPP server, open a stream by sending the opening `stream:stream` tag and a container element, then stream child elements continuously and never send the container's closing tag. No credentials are required, because in XMPP the stream is parsed before authentication.

Every child is appended to the container and retained because the container is never emitted, and the transport applies no limit on the size of the unfinished document. Because each small element becomes a full object in memory the footprint is many times the traffic sent, so a modest-bandwidth peer, or several such streams, drives the process to memory exhaustion.

## Impact

This is an unauthenticated remote denial of service by memory exhaustion. A single stream grows an in-memory element tree without bound, amplified by per-element object overhead, until the operating system kills the server. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that parses untrusted XML streams with this stack, such as an XMPP server or component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_