Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and
    earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards
    but passes all other characters from an authenticated client's LIST or LSUB pattern directly to
    re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic
    backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded
    reactor, the blocking match suspends all server input and output for the duration of the match. No fixed
    release is available as of this review. (CVE-2026-106454)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and     earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards     but passes all other characters from an authenticated client's LIST or LSUB pattern directly to     re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic     backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded     reactor, the blocking match suspends all server input and output for the duration of the match. No fixed     release is available as of this review. (CVE-2026-106454)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478037	Chainguard: synapse: security update to 1.164.1-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478037	Chainguard: synapse: security update to 1.164.1-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
371387	Linux Distros Unpatched Vulnerability : CVE-2026-106454	Nessus	Misc.	Local	medium
473712	SCA: security update for Twisted (GHSA-8pqf-f4m5-798g)	Tenable Cloud Security	SCA Checks	Local	medium
473712	SCA: security update for Twisted (GHSA-8pqf-f4m5-798g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-106454

medium

Tenable Plugins

medium

medium

medium

medium

medium