{"id":"AZL-111422","summary":"CVE-2026-115775 affecting package python-twisted 22.10.0-6","details":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.","modified":"2026-10-29T14:16:54.867286316Z","published":"2026-10-23T21:17:23Z","upstream":["CVE-2026-115775"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115775"}],"affected":[{"package":{"name":"python-twisted","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-twisted"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.10.0-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111422.json"}}],"schema_version":"1.9.2"}