Your message dated Wed, 07 Oct 2026 15:36:48 +0000
with message-id <[email protected]>
and subject line Bug#1150248: fixed in twisted 26.4.0-5
has caused the Debian Bug report #1150248,
regarding twisted: CVE-2026-106454
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150248: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150248
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: twisted
Version: 26.4.0-4
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://github.com/twisted/twisted/pull/12788
Hi,
The following vulnerability was published for twisted.
CVE-2026-106454[0]:
| Twisted is an event-based framework for internet applications,
| supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in
| twisted/mail/imap4.py translates the IMAP asterisk and percent
| wildcards but passes all other characters from an authenticated
| client's LIST or LSUB pattern directly to re.compile(), allowing
| nested or otherwise expensive regular expression constructs to cause
| catastrophic backtracking when matched against mailbox names.
| Because Twisted uses a cooperative single-threaded reactor, the
| blocking match suspends all server input and output for the duration
| of the match. No fixed release is available as of this review.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-106454
https://www.cve.org/CVERecord?id=CVE-2026-106454
[1] https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g
[2] https://github.com/twisted/twisted/pull/12788
[3]
https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: twisted
Source-Version: 26.4.0-5
Done: Colin Watson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
twisted, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <[email protected]> (supplier of updated twisted package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 07 Oct 2026 16:17:29 +0100
Source: twisted
Architecture: source
Version: 26.4.0-5
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Colin Watson <[email protected]>
Closes: 1150248
Changes:
twisted (26.4.0-5) unstable; urgency=medium
.
* CVE-2026-106454: Fix IMAP wildcardToRegexp() ReDoS (closes: #1150248).
Checksums-Sha1:
b0f3b91175fea9be214f58b37ae4922550c42e7b 3042 twisted_26.4.0-5.dsc
bcfca6fe1923ec0f09371b586d29f1df5a149c67 32296 twisted_26.4.0-5.debian.tar.xz
7957521245d27cc40a34a0108303f4c2c389b5d9 7071228 twisted_26.4.0-5.git.tar.xz
cdd6b10b9f41095598e55eeddb20db70b87ddb32 17728
twisted_26.4.0-5_source.buildinfo
Checksums-Sha256:
f0ab255984c6e4fea3008f49465088602fdda28720e86a86d623210e8a3eceb8 3042
twisted_26.4.0-5.dsc
9987f3635150731b11ba82581ca495f735f44ce2823e35ec1aada0b1744ae2e4 32296
twisted_26.4.0-5.debian.tar.xz
659e91ba81977660d928d8dcca029585581239283a68a1a1be263b793cb2a266 7071228
twisted_26.4.0-5.git.tar.xz
4e4ed0ee41de7c085e3df885fa191776a9fe5cd215ec5545564f006f4435d73d 17728
twisted_26.4.0-5_source.buildinfo
Files:
472aad90e00c75eaa5b3a0656559ee18 3042 python optional twisted_26.4.0-5.dsc
7e6cdb62aa714722cf461eba99bf2b18 32296 python optional
twisted_26.4.0-5.debian.tar.xz
6729bf12b4e93f4d3fd716a3bab812b9 7071228 python None
twisted_26.4.0-5.git.tar.xz
88f9c8767b13484d043c992a71e6f5f7 17728 python optional
twisted_26.4.0-5_source.buildinfo
Git-Tag-Info: tag=cafe51875479bcc573972204bc0fb61251224ad5
fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrGY8kACgkQYG0ITkaD
wHnCqg/9GmXletv1TwbANn7AQY3X6o/F/e0/8uPm7/VPcUgGizZmhCWBp3hQySCA
ISxk+022ZRzgpXlya/CdGIFT/w2CtOZ8ZxIZxb3EpmxQxDYsJOs2HroxPDbDOpwA
bkNtmGEDdrLl1NN83AmVWdCnpoQNxlAO6RrcIaAOpw2U4gsTrz5n8mme17i7PxIE
MPWAOpMixYeDwERuaAMLzA0cevry7bUe6z0EqLOa0CvwAblH81Dx2ZBLlM5yWN7I
dc/xssj1e0kzcXzwiL15MC1oS4XOnRN4CmOer8uMHhYknCzE1m0cQH5qD/nnAyvF
ftu1aYYf/YhqMAvYv1fdQec8gzi4eYoIpDIg98LGWRCd1x0QrGovfmLbbOl9/Tqo
/JF34xsIusS+k5O/vO+edhnKx5sQe5FVd3fXVteU4N+yk6yChTtqf9gKWlYOEC58
TUi4BgEClfpd9a82NkkVeoGs6XemiiB5KxYABGzTO8o+/Q07MXXvc0X8BuQmP78T
r9i2UJFPhq2VZS7cDpzKjhfAwonCH1vtyfAjCdjBk5Hu0HujVlJp22cQtzrlwp6G
wG7dqG0NulHOeuTZCdyaGPFOThvgPHUHqpkuoRjdcZrHhfn6k5zbA3jqjpoGbx1c
6bHDPcjrKHw+iFB5GibZSGTJSbc/LQ+PCyvIwvsrcWBLrDsNkcI=
=Cng/
-----END PGP SIGNATURE-----
pgp_cJp_04Mu4.pgp
Description: PGP signature
--- End Message ---
