Live › vulnerability › CVE-2026-83813
Go to dashboardTwisted's DNS datagram protocol accepts a UDP reply whose 16-bit transaction ID matches a pending query without checking the sender's address and port. An off-path attacker who can send packets to the resolver and guess the transaction ID can inject a fake answer, redirecting hostname lookups for mail interception, SSRF or man-in-the-middle positioning.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that perform DNS resolution through Twisted's twisted.names DNS code, especially those that reuse one DNSDatagramProtocol instance, are exposed. Standard twisted.names.client.Resolver use with per-query random source ports is harder to attack, but the sources still call it affected before the fix. Applications that do not use twisted.names for DNS lookups can skip it.
No product ranges from the sources yet.
python -c "import twisted; print(twisted.__version__)" or pip show twistedDNSDatagramProtocol instance for multiple queries, since the search space is reduced after the first query26.10.0rc1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.
This page as .md · .json · in your agent: get_signal("CVE-2026-83813")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.