CVE-2026-106454
Publication date 6 October 2026
Last updated 4 November 2026
Ubuntu priority
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| twisted | 26.10 stonking |
Fixed in 26.4.0-4ubuntu0.1
|
| 26.04 LTS resolute |
Fixed in 25.5.0-5ubuntu0.2
|
|
| 24.04 LTS noble |
Fixed in 24.3.0-1ubuntu0.3
|
|
| 22.04 LTS jammy |
Fixed in 22.1.0-2ubuntu2.8
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
Related Ubuntu Security Notices (USN)
- USN-9000-1
- Twisted vulnerability
- 4 November 2026