Is CVE-2026-115775 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115775 being exploited in the wild.

How severe is CVE-2026-115775?

High severity, with a CVSS score of 4, published 23 October 2026.

Which products and versions are affected?

twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.

Is there a fix for CVE-2026-115775?

Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115775 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115775?

Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115775: Twisted unbounded element tree denial of service

Q: Which products and versions are affected?

twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.

Q: Is there a fix for CVE-2026-115775?

Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115775 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-115775?

Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115775 · Severity: high · CVSS 4 · Published 2026-10-23

Twisted is a Python networking library used in XMPP servers and other XML-streaming applications. An attacker can send a specially crafted XML stream without authentication to exhaust the server's memory and crash it, by continuously sending child elements inside an unclosed container tag. This allows unauthenticated remote denial of service with minimal network bandwidth.

Technologies: twisted (PyPI), Twisted. Vendors: PyPI, Twisted.

Quick answers

Is CVE-2026-115775 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115775 being exploited in the wild.
How severe is CVE-2026-115775?: High severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?: twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.
Is there a fix for CVE-2026-115775?: Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115775 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115775?: Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

twisted (PyPI): upgrade to 26.10.0rc1 or later
```
pip install "twisted>=26.10.0rc1"
```

Technical details

The vulnerability is an allocation-without-limits flaw in ExpatElementStream._onStartElement (twisted.words.xish.domish) that appends each incoming element to its parent's children list with no depth or child-count validation. Elements are only released when their end tags arrive; an attacker can open a container element, stream unlimited child elements, and never close the container, forcing unbounded in-memory tree growth until memory exhaustion. The attack is possible before authentication because XML parsing occurs during stream negotiation in XMPP.

Affected products

Twisted Twisted 26.4.0 and earlier

Identifiers

CVE-2026-115775
GHSA-3476-c5c2-fr73

Timeline

2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.