{"items":[{"id":"NVI-00018633","kind":"vulnerability","title":"Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-grgv-6hw6-v9g4","CVE-2026-42304"],"plain_summary":"GitHub lists this reviewed advisory for Twisted. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-472840ae2a5aca00cc0c7c7462bc6f77"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T20:05:10.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-472840ae2a5aca00cc0c7c7462bc6f77"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-472840ae2a5aca00cc0c7c7462bc6f77","url":"https://github.com/advisories/GHSA-grgv-6hw6-v9g4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-grgv-6hw6-v9g4","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:51:53.608Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-472840ae2a5aca00cc0c7c7462bc6f77"],"technology":"Twisted","known_exclusions":[],"conditions_summary":"### Details\n\nThe twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server.\n\n---\n\n### Technical Details\n\nThe main issue is in twisted.names.dns.Name.decode. A visited set was added in 2011 (commit e11cd82) to prevent infinite loops, but there is still no limit on the number of pointer dereferences per message. Also, the visited set is reset for each Question record.\n\nBecause DNSServerFactory handles every record in QDCOUNT without checking them, an attacker can add thousands of questions that all refer to the same long chain of pointers. This makes the parser repeat a complex and unnecessary search.\n\n```python\n##  src/twisted/names/dns.py (Lines 595-631)\n\ndef decode(self, strio, length=None):\n        visited = set()\n        self.name = b\"\"\n        off = 0\n        while 1:\n            l = ord(readPrecis","public_affected_ranges":["<= 25.5.0"]}],"null_published_at":"2026-11-07T07:07:39.864Z","source_updated_at":"2026-06-08T20:05:10.000Z","source_disclosed_at":"2026-05-05T21:12:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:51:53.608Z"}],"next_cursor":null,"snapshot_revision":"42594"}