CVE-2026-115776
Description
A flaw was found in Twisted. The Internet Relay Chat (IRC) protocol implementation does not enforce a maximum line length when buffering incoming connection data. An unauthenticated remote attacker can exploit this by sending a continuous stream of data without line feed characters to an IRC service. This causes the server process to consume excessive memory until it runs out of resources, resulting in a Denial of Service (DoS) that terminates connections for all users.
Statement
Red Hat rates this vulnerability as having an Important severity impact because an unauthenticated remote attacker can cause process-wide memory exhaustion and a complete denial of service without requiring user interaction or specialized privileges. Although the underlying Twisted package is distributed with Red Hat Ansible Automation Platform and Red Hat OpenStack Platform, standard configurations do not deploy or expose an Internet Relay Chat (IRC) service. As a result, typical product deployments are not reachable via this vector unless custom workloads explicitly expose Twisted's IRC server implementation to untrusted networks.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to bound incoming line buffering in Twisted IRC server protocols to drop unterminated network streams before memory exhaustion: upgrade to Twisted 26.10.0rc1 (or the fixed Python Twisted/Python3X Twisted/Ansible Automation Platform 25/Lightspeed Rhel/Python3.11 Twisted/Python3.12 Twisted/Ansible Automation Platform 24/Controller Rhel/Ansible Automation Platform 25/Controller Rhel/Ansible Automation Platform 26/Controller Rhel/Ansible Automation Platform 26/Eda Controller Rhel/Ansible Automation Platform 27/Eda Controller Rhel/Automation Controller/Ansible Automation Platform 27/Controller Rhel/Ansible Automation Platform 26/Lightspeed Rhel/Ansible Automation Platform 27/Lightspeed Rhel/Ansible Ai Connect Service builds), which enforce a MAX_LENGTH limit of 16384 bytes in dataReceived and invoke lineLengthExceeded to clear the buffer and drop the connection when exceeded, closing all 2 injection vectors (continuous data streaming without line feed delimiters, overlong IRC protocol lines). Until patched, this is a concern on deployments exposing Twisted IRC server services to untrusted networks, so restrict network access to Twisted IRC services, disallow exposure to untrusted networks, and apply network firewalls or upstream proxies to prevent unauthenticated direct connections. As a compensating measure, monitor cgroup memory events and pressure stall information (PSI) to detect rapid memory exhaustion caused by unbounded buffering, impose address space limits (RLIMIT_AS) via ulimit or prlimit on the Twisted process to contain memory exhaustion to the process boundary, sanitize and validate newline delimiters in incoming protocol streams to reject malformed or unbounded records, constrain memory consumption for the Twisted service process group using cgroups v2 resource limits to contain host-wide denial of service, and throttle incoming connection data rates to slow the rate of unauthenticated data buffering. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded line buffering defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
