Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to
    26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative
    literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The
    negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous
    scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP
    connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in
    version 26.10.0rc1. (CVE-2026-115774)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to     26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative     literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The     negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous     scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP     connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in     version 26.10.0rc1. (CVE-2026-115774)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478036	Chainguard: synapse: security update to 1.164.1-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478036	Chainguard: synapse: security update to 1.164.1-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
477264	SCA: security update for Twisted (GHSA-2qrf-pqgx-qh9v)	Tenable Cloud Security	SCA Checks	Local	medium
477264	SCA: security update for Twisted (GHSA-2qrf-pqgx-qh9v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
371711	Linux Distros Unpatched Vulnerability : CVE-2026-115774	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-115774

medium

Tenable Plugins

medium

medium

medium

medium

medium