ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-83813

Twisted is an event-based framework for internet applications, supporting Python 3.6+.

Published Oct 23, 2026 · catalog updated Oct 24, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-83813. EPSS is 0.11%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.11%
Remediation
Advisory link
Affected products
Debian:12 twisted · Debian:13 twisted · Debian:14 twisted · pypi twisted · vendor twisted twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:12 twisted22.4.0-4, 22.4.0-4+deb12u1, 23.10.0-1
  • Debian:13 twisted24.11.0-1, 25.5.0-1, 25.5.0-2
  • Debian:14 twisted24.11.0-1, 25.5.0-1, 25.5.0-2
  • pypi twistedversion unspecified
  • vendor twisted twistedversion unspecified

How to fix CVE-2026-83813

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-83813. EPSS is 0.11%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with 22.4.0-4, 22.4.0-4+deb12u1, 23.10.0-1, 24.11.0-1, 25.5.0-1, 25.5.0-2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-346. EPSS 0.11%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · Red Hat Security Data

    Detected

    twisted: twisted: DNS spoofing via missing response source verification

  2. Oct 24, 2026 · Trivy Vulnerability DB

    Updated

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transa

Sources

  • CVE.orgVulnerability recordCVE-2026-83813

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-83813

    30-day exploitation probability 0.11%

    first.org
  • GitLab Advisory DatabasePackage advisoryCVE-2026-83813

    twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client (twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail), accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID matching. It never checks that the response actually originated from the server the query was sent to. Any ho

    advisories.gitlab.com
  • Red Hat Security DataVendor advisoryCVE-2026-83813

    twisted: twisted: DNS spoofing via missing response source verification

    access.redhat.com
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-83813

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from

    osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 28, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • Red Hat Security DataOct 26, 2026
  • CVE.orgOct 24, 2026
  • Trivy Vulnerability DBOct 24, 2026