Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 29 October 2026.

Which products and versions are affected?

twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.

Is there a fix for This vulnerability?

Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Twisted HTTP/2 server denial of service via rapid stream reset

Q: Which products and versions are affected?

twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.

Q: Is there a fix for This vulnerability?

Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.5 · Published 2026-10-29

Twisted is a networking framework used to build web servers and applications. An unauthenticated attacker can crash or severely degrade any Twisted HTTP/2 server by sending a stream of specially crafted reset requests on a single connection, exhausting CPU resources without requiring login credentials. This allows a single attacker to take down a web service with minimal network traffic.

Technologies: twisted (PyPI), Twisted. Vendors: PyPI, Twisted.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 29 October 2026.
Which products and versions are affected?: twisted (PyPI) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.10.0rc1; Twisted 26.4.0 and earlier.
Is there a fix for This vulnerability?: Yes. twisted (PyPI): upgrade to 26.10.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run twisted (PyPI) or Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

twisted (PyPI): upgrade to 26.10.0rc1 or later
```
pip install "twisted>=26.10.0rc1"
```

Technical details

The Twisted HTTP/2 server processes stream events in order—including handling `HEADERS(END_STREAM)` followed by `RST_STREAM`—but routes and renders requests before freeing reset streams. Since reset streams do not count against the concurrent-stream limit and no rate limiter exists, an attacker can trigger unbounded request rendering at line rate on one connection, saturating CPU. This is the HTTP/2 Rapid Reset vulnerability class (CVE-2023-44487), exploitable without authentication or user interaction.

Affected products

Twisted Twisted 26.4.0 and earlier

Timeline

2026-10-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.