-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 12:40:29 +0000 Source: twisted Architecture: source Version: 26.10.0-1 Distribution: unstable Urgency: medium Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 1151938 Changes: twisted (26.10.0-1) unstable; urgency=medium . * New upstream release (closes: #1151938): - CVE-2023-44487: twisted.web's HTTP/2 server now limits the rate at which a remote peer may reset streams, mitigating the HTTP/2 Rapid Reset denial-of-service attack. - CVE-2026-83813: twisted.names.dns.DNSDatagramProtocol.query now discards query responses that come from hosts other than the one the query was issued to, preventing other hosts from injecting invalid DNS responses. - CVE-2026-115774: twisted.mail.imap4.IMAP4Server now rejects a SEARCH command containing a literal with a negative octet count, so an authenticated client can no longer freeze the server with a crafted command. - CVE-2026-115775: The domish XML element streams in twisted.words.xish (used to parse XMPP) now limit the byte size and element count of a single stanza, so a peer can no longer exhaust server memory by sending an unbounded stanza. - CVE-2026-115776: twisted.words.protocols.irc.IRC.dataReceived now limits the length of a single line, so a peer can no longer exhaust server memory by sending data without a line delimiter. - CVE-2026-115778: twisted.conch.telnet.Telnet.dataReceived now limits how much data it buffers for a single telnet subnegotiation, so a peer can no longer exhaust server memory by sending a subnegotiation that is never terminated. - CVE-2026-115877: twisted.web.http.HTTPChannel.headerReceived now rejects a header value that contains a bare carriage return or line feed, closing a request-smuggling gap where such a value could hide a following header from the parser (RFC 9110 section 5.5). * Fix Python 3.15 compatibility issues. Checksums-Sha1: 96fe368ba603548587a447faaae6b21198da6627 3068 twisted_26.10.0-1.dsc b4bedd289d8af46c72baddd416545c0e4f45bad6 2722848 twisted_26.10.0.orig.tar.xz ae019c05e5d2d8971d8baf5be3cae3797320c887 30156 twisted_26.10.0-1.debian.tar.xz a572f8ed2a0f0691d6fdcefab0fa9cb2ffe615c1 6504488 twisted_26.10.0-1.git.tar.xz d2e4bc3d748a5653e5716c4141793703859bc9df 17745 twisted_26.10.0-1_source.buildinfo Checksums-Sha256: 515ba5fd1242be9b7b9042a0a416d0d8138f6c2c65110b86193bba37a5bd6e5b 3068 twisted_26.10.0-1.dsc 6aefca456e5d8944e9f3e19303b8f6e08182b03620dc8d37bb4051355423fa94 2722848 twisted_26.10.0.orig.tar.xz 683ea1ed101a595849dda045565de3abe277f1950801049af7f027e83ecdf197 30156 twisted_26.10.0-1.debian.tar.xz 48e3d5a30aa158521db07e32b2318b0ce03e5222bf8413f76f862814e77c4280 6504488 twisted_26.10.0-1.git.tar.xz 6444851f370dc6b239996b9d87bef881986e943c4fbcfbdf2ff39e289929411b 17745 twisted_26.10.0-1_source.buildinfo Files: 5804d85032c4b4240aa84c7ec76437c7 3068 python optional twisted_26.10.0-1.dsc e9b094ef53ea6f0c089d8ca3e1a6a4e9 2722848 python optional twisted_26.10.0.orig.tar.xz f675a1e6e426d6280225fcff9f274145 30156 python optional twisted_26.10.0-1.debian.tar.xz ea36fdae4ddf01c8a5b4d78fb6664d9a 6504488 python None twisted_26.10.0-1.git.tar.xz 0939254c0ec7960cadb630cecde25fe7 17745 python optional twisted_26.10.0-1_source.buildinfo Git-Tag-Info: tag=e6e72d8d9ea36af6b04f773ba2ea7547c83ba77f fp=ac0a4ff12611b6fccf01c111393587d97d86500b Git-Tag-Tagger: Colin Watson <cjwatson@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrkkpsACgkQYG0ITkaD wHm+gBAAyxesVZs7TlOwinpR2JREvpG/hbUIP4n+FX9U7VjB+ZGolMB9JOE7oMHj iDhCVA0+uk+HnFllfK5iw5ImHbHHhzvqfo4CtTXWta/dwt78C6qYP+Wy0LbJN+P7 BF4XQn/LKDX49zOt4CdiVe3VXssbM1JNvlfj9hj0Nx/Q+x9UxHPEKCcbmzHBjY+5 u0AAgMId5dnXrpGuVZyNQ1J68sIrBYXVE8rUwZ2NcadUPN+okL1dv+V5ADXszbl5 e7o9KOFdcCWgENXHZyGI2IVuoraKYJvMi6xWI6r4wtD0N7blIPYIvjTbP3yE+8E4 OtvRC/wHChJmFuQwE9ERW2OardfNI40IWxkbj05wmlc84pVSFYJToLKodTqeYW1+ cyhHKJZP6c1QpljhXZ/1EYy2mr/F9KyVjZMhSaYii7z+Dr6I7ccoeq7LxsI9S1z8 VPdO3p1hiH7ICRpsGp/HvpDXnaqjdPD4ao2InpBaX8UhKrPdt7FGZcKhjBBj6NcG RbZqtjwjwA8vXnVJRHvP6zpI2RqTqkGxMGat9RMKguC/jlsED42f1mEcZ/4OlFZT 14FHeEeg9LKIDcuGTHrd/WVIGnzdu5FiEyLrF52V5ZbphtGBrKUr8tH/0AAvp4zt o4Uu1nm0Y3Vvd0nke8LRXI01gsVLGI0lvPqTbP//NWCNBnNd4lw= =1llp -----END PGP SIGNATURE-----
