Twisted IMAP4 Server CVE-2026-115774

Requires: (1) a Twisted deployment actually running twisted.mail.imap4.IMAP4Server (e.g. twistd mail); (2) a valid authenticated session - the vulnerable select_SEARCH/arg_searchkeys path is only dispatched in the selected state, so the attacker must LOGIN successfully and SELECT a mailbox; and (3) a SEARCH command carrying an inline literal with a negative octet count (e.g. {-100}), which parseNestedParens fails to reject. The pre-existing _literalStringLimit guard does not cover this inline branch. Limiting factors: exploitation needs valid credentials (authenticated per the CVSS vector's PR metric, and per the advisory any low-privilege account is sufficient); it only affects installations exposing the Twisted IMAP4 server, which is a minority of Twisted deployments. Aggravating factor: because the reactor is single-threaded, the freeze also stops all other connections and any SMTP/POP3 services sharing the process, and the connection timeout cannot fire because the reactor itself is frozen.

This is a genuine but moderate-priority availability issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9 MEDIUM) and CWE-400/CWE-835 agree on the mechanism: a single authenticated SEARCH command containing a negative IMAP literal size (e.g. {-100}) drives twisted.mail.imap4.parseNestedParens into a non-terminating loop that pins the single-threaded reactor at 100% CPU, denying service to every connection and every other service (SMTP/POP3) co-hosted in the same process until restart. No confidentiality or integrity impact and no code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a MEDIUM DoS. Signals are mostly aligned, but with one notable conflict: the input CVSS encodes PR:H (high privilege), whereas the GHSA advisory explicitly states 'any low-privilege account' / 'any account holder can trigger it' after a normal login and mailbox SELECT - this points to PR:L, which would raise the realistic risk slightly. No EPSS score and no CISA KEV entry were provided (exploitation status: no active exploitation confirmed), so there is no evidence of in-the-wild use; the GHSA advisory does, however, publish concrete reproduction steps. The required authenticated session and the relatively niche deployment of Twisted's IMAP4 mail server are the main factors keeping real-world risk below the raw network-reachable framing.

An attacker who holds any valid mailbox account (or has obtained low-privilege credentials) logs into a Twisted-based IMAP4 server, issues SELECT INBOX to enter the selected state, then sends a SEARCH command whose literal size is negative, e.g. 'SEARCH {-100}zzzzzzzzzz'. The reactor enters an infinite synchronous scanning loop and freezes the entire process, taking down all IMAP connections plus any SMTP/POP3 services hosted in the same twistd mail process until manual restart. The GHSA advisory includes working reproduction steps (login → select → crafted SEARCH), so a reliable trigger is publicly documented.