Source: twisted Version: 26.4.0-4 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/twisted/twisted/pull/12788
Hi, The following vulnerability was published for twisted. CVE-2026-106454[0]: | Twisted is an event-based framework for internet applications, | supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in | twisted/mail/imap4.py translates the IMAP asterisk and percent | wildcards but passes all other characters from an authenticated | client's LIST or LSUB pattern directly to re.compile(), allowing | nested or otherwise expensive regular expression constructs to cause | catastrophic backtracking when matched against mailbox names. | Because Twisted uses a cooperative single-threaded reactor, the | blocking match suspends all server input and output for the duration | of the match. No fixed release is available as of this review. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106454 https://www.cve.org/CVERecord?id=CVE-2026-106454 [1] https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g [2] https://github.com/twisted/twisted/pull/12788 [3] https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f Please adjust the affected versions in the BTS as needed. Regards, Salvatore
