Back to Security Advisories

Twisted Vulnerability — Ubuntu Security Update (USN-9000-1)

USN-9000-1 fixes CVE-2026-106454 in Twisted on Ubuntu: the IMAP server mishandled wildcard patterns in mailbox LIST commands, letting an authenticated remote user drive excessive resource consumption — a denial-of-service flaw (CWE-1333 inefficient regex/ pattern class, CVSS 4.3). Update: sudo apt update && sudo apt upgrade and restart Twisted-based services.

High 4.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Authenticated DoS flaws in mail-infrastructure libraries let any valid account degrade the mail service for everyone — no exploit skill needed beyond a crafted LIST pattern.

  1. Ubuntu Security Notices

  2. USN-9000-1

Publication date

4 November 2026

Overview

Twisted could be made to crash if it received specially crafted
network traffic from an authenticated user.

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS

Open side navigation

Packages

  • twisted – Event-based framework for internet applications

Details

It was discovered that Twisted’s IMAP server mishandled wildcard
patterns in mailbox list commands. An authenticated remote attacker
could possibly use this issue to cause Twisted to use excessive
resources, leading to a denial of service.

It was discovered that Twisted’s IMAP server mishandled wildcard
patterns in mailbox list commands. An authenticated remote attacker
could possibly use this issue to cause Twisted to use excessive
resources, leading to a denial of service.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 python3-twisted – 

26.4.0-4ubuntu0.1
26.04

LTS resolute

 python3-twisted – 

25.5.0-5ubuntu0.2
24.04

LTS noble

 python3-twisted – 

24.3.0-1ubuntu0.3
22.04

LTS jammy

 python3-twisted – 

22.1.0-2ubuntu2.8

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Frequently Asked Questions

What is CVE-2026-106454?
It is a resource-exhaustion flaw (CWE-1333 — inefficient wildcard pattern processing) in Twisted's IMAP server: an authenticated remote user can issue crafted mailbox LIST commands that consume excessive resources. CVSS 4.3; fixed in USN-9000-1.
Who is affected?
Ubuntu servers running IMAP services built on Twisted — Python mail platforms and application servers exposing IMAP through Twisted protocols.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade for the Twisted packages and restart the mail/IMAP services so they run the patched library.
Why does an authenticated-only flaw still matter?
On mail systems every customer already holds valid credentials — an authenticated DoS lets any one tenant degrade the mail service for all others, which is disruption no hosting provider can tolerate.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System