CVE-2026-83813: Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted’s DNS client (twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail), accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID matching. It never checks that the response actually originated from the server the query was sent to. Any host that can deliver a UDP packet to the resolver’s listening port with the correct transaction ID can inject a forged answer, independent of the real server’s address. This is a materially weaker defense than standard DNS resolver practice (transaction ID plus source-address validation, typically also source-port rotation), and enables off-path DNS response spoofing / cache poisoning.
References
- github.com/advisories/GHSA-jj36-9pvh-vj5r
- github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac
- github.com/twisted/twisted/pull/12700
- github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
- github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
- nvd.nist.gov/vuln/detail/CVE-2026-83813
Code Behaviors & Features
Detect and mitigate CVE-2026-83813 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →