CVE-2026-106454: Twisted IMAP WildcardToRegexp() ReDoS Vulnerability
Summary
CVE-2026-106454: Twisted: IMAP wildcardToRegexp() ReDoS. Affects twisted versions < 25.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Twisted is an event-driven networking engine written in Python, widely used for building networked applications. It provides a framework for developing asynchronous network applications, including protocols like IMAP. The package is known for its cooperative multitasking capabilities, allowing it to handle multiple connections efficiently. However, a vulnerability exists in the IMAP LIST/LSUB wildcard pattern handling, which can lead to denial of service through regular expression catastrophic backtracking.
Vulnerability Detail
The vulnerability arises from the wildcardToRegexp() function in twisted/mail/imap4.py, which converts IMAP LIST/LSUB wildcard patterns into Python regular expressions. It allows an authenticated IMAP client to send a quoted pattern string containing arbitrary regex syntax, including constructs that can cause catastrophic backtracking. This can lead to a blocking regex match that freezes all I/O on the server, making it unresponsive to other connections. An attacker can exploit this by creating a mailbox with a specially crafted name and issuing a LIST command, causing the server to stall for an extended period.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, you can implement a workaround by modifying the wildcardToRegexp() function to escape all non-wildcard characters. Here is the modified code:
def wildcardToRegexp(wildcard, delim=None):
# Split on the two IMAP wildcards, escape everything else
parts = re.split(r'([*%])', wildcard)
result = []
for p in parts:
if p == '*':
result.append('(?:.*?)')
elif p == '%':
if delim is None:
result.append('(?:.*?)')
else:
result.append('(?:(?:[^%s])*?)' % re.escape(delim))
else:
result.append(re.escape(p)) # Escape all other characters
return re.compile(''.join(result), re.I)
Conclusion
The CVE-2026-106454 vulnerability in the Twisted package poses a significant risk of denial of service through regex catastrophic backtracking. It is crucial to update to a patched version or implement the provided workaround to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for twisted →
FAQ
CVE-2026-106454 is a vulnerability in the Twisted package that allows for denial of service through regular expression catastrophic backtracking in the IMAP wildcard handling.
An attacker can exploit this vulnerability to freeze the server, making it unresponsive to other connections, which can lead to service downtime.
Versions of Twisted up to and including 25.5.0 are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
