Twisted EUVD-2026-93873

Requires an authenticated IMAP session (PR:L) against a Twisted-based IMAP4 server (version 25.5.0 or earlier) that exposes LIST or LSUB commands - i.e., the deployment must actually run Twisted's twisted.mail.imap4 server component. The attacker must supply a LIST/LSUB mailbox pattern containing regex metacharacters beyond the IMAP '*' and '%' wildcards (e.g., nested quantifiers) that Twisted forwards directly to re.compile(). Limiting factors: valid credentials are mandatory (no unauthenticated path), and impact is confined to availability; exploitation is amplified by Twisted's cooperative single-threaded reactor, which lets a single malicious match stall the entire server. No fixed release is available, so mitigation currently depends on access controls or input filtering rather than patching.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) correctly captures a network-reachable, low-complexity denial-of-service with availability-only impact and no confidentiality or integrity loss. The PR:L metric confirms exploitation requires an authenticated IMAP session, which meaningfully limits the attacker population to users who already hold valid mailbox credentials. No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, and no public exploit was referenced, so there is no public exploit identified at time of analysis; the absence of these signals is consistent with a low-urgency, authenticated DoS rather than mass exploitation. One nuance worth flagging: although CVSS scope is marked S:U, the real-world blast radius is larger than a single session because Twisted's cooperative single-threaded reactor means one blocking regex match suspends ALL server I/O for every connected client - effectively a full-server stall triggered by one authenticated user. This systemic amplification is not reflected in the S:U/A:L scoring and should be weighed up for any multi-tenant IMAP deployment. Critically, no fixed release is available as of this review, so defenders cannot simply patch; this raises operational risk relative to the low score.

An authenticated IMAP user issues a LIST or LSUB command whose pattern contains nested or otherwise pathological regular-expression constructs that Twisted passes directly to re.compile(). When matched against mailbox names this triggers catastrophic backtracking, and because the reactor is single-threaded the match blocks all other client traffic for the duration. No public exploit code was referenced, but the vulnerable path and fix are documented in the GHSA advisory and the linked commit.