CVE-2026-106454

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106454

EUVD

EUVD-2026-93873

Affected Vendors & Products

Vendor	Product	Version / Range
twisted	twisted	<= 25.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Twisted framework's IMAP4 implementation. The issue is in the wildcardToRegexp() function which processes LIST or LSUB commands from authenticated clients. It improperly handles certain characters by passing them directly to a regular expression compiler, enabling malicious patterns that cause excessive CPU usage through catastrophic backtracking. This can block the entire server due to its single-threaded reactor model.

Detection Guidance

This vulnerability involves catastrophic backtracking in regular expressions used by Twisted's IMAP server. Detection requires checking for vulnerable Twisted versions (25.5.0 or earlier) and monitoring for excessive CPU usage during IMAP LIST or LSUB commands. No specific commands are provided in the context to detect this issue.

Impact Analysis

If you run a server using Twisted 25.5.0 or earlier with IMAP4 enabled, an attacker with valid credentials could send specially crafted LIST or LSUB commands. This would cause high CPU usage, potentially leading to service degradation or denial of service for all users. The attack requires authentication but no special privileges beyond basic access.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through catastrophic backtracking, disrupting service availability. The blocking match suspends all server input and output, which may violate availability requirements in these regulations.

Mitigation Strategies

Upgrade Twisted to a version later than 25.5.0 if available. If no fixed release exists, restrict access to IMAP LIST or LSUB commands via network controls until a patch is released.

Hi! I’m here to help you understand CVE-2026-106454. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70