CVE-2026-106454
Description
A flaw was found in Twisted. An authenticated remote attacker can cause a Denial of Service (DoS) by submitting specially crafted mailbox search queries using Internet Message Access Protocol (IMAP) commands such as LIST or LSUB. Because the server fails to properly sanitize these search patterns before compiling them, complex patterns can trigger excessive processing delays known as regular expression catastrophic backtracking. Due to the framework's single-threaded event loop, this blocking operation halts all server traffic, rendering the application unresponsive to other clients.
Statement
A MODERATE severity regular expression denial of service (ReDoS) flaw was found in Twisted, an event-based Python framework bundled within several Red Hat products, including OpenShift Container Platform (Kuryr components), Red Hat Ansible Automation Platform (automation controller, event-driven automation controller, and Ansible Lightspeed containers), and Ansible Services offerings. The wildcardToRegexp() function in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB mailbox pattern directly to re.compile() without escaping. A remote attacker with an authenticated IMAP session can submit a crafted pattern containing nested quantifiers or other catastrophic-backtracking constructs; when the compiled pattern is matched against mailbox names, the blocking match suspends the framework's cooperative single-threaded reactor, halting all server input and output and rendering the application unresponsive to all other clients for the duration of the match. Only availability is affected; confidentiality and integrity are not (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), which is consistent with the upstream severity rating. Exposure requires a service built on Twisted's IMAP server implementation; the delegated review of the Red Hat Hardened Images component determined that the affected component is not present there. For most affected Red Hat product streams, remediation is deferred because the issue is MODERATE severity with a CVSS score below 7.0, and no fixed upstream release is currently available; the residual risk is that an authenticated IMAP user can repeatedly stall the server. Certain affected streams are out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
