CVE-2026-42304: Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

May 5, 2026 (updated June 8, 2026)

A single malformed TCP packet is sufficient to block the Twisted reactor’s event loop for several seconds. Because Twisted operates on a single-threaded cooperative multitasking model, this is a common Denial of Service (DoS). The process becomes unable to handle new connections, process I/O, or respond to existing requests, effectively paralyzing the server for the duration of the decompression.

References

github.com/advisories/GHSA-grgv-6hw6-v9g4
github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2026-160.yaml
github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09
github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4
nvd.nist.gov/vuln/detail/CVE-2026-42304

Code Behaviors & Features

Detect and mitigate CVE-2026-42304 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →