PyPI PACKAGE

twisted 26.4.0

Warn

PkgFire would install this release with a warning.·Checked 16 hours ago·Published 11 May 2026

pypi.org

Why

  • warnVulnerability

    Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (fixed in 26.10.0rc1)

  • warnVulnerability

    Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (fixed in 26.10.0rc1)

  • warnVulnerability

    Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (fixed in 26.10.0rc1)

  • warnVulnerability

    Twisted: IMAP wildcardToRegexp() ReDoS

  • warnVulnerability

    Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (fixed in 26.10.0rc1)

  • warnVulnerability

    Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (fixed in 26.10.0rc1)

  • warnVulnerability

    Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset (fixed in 26.10.0rc1)

Provenance

A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.

Signature
Not signed
Build provenance
Attested

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.

Code reading

PkgFire's own reading of the files: what the code can do.

  • code-credentialssrc/twisted/conch/checkers.py, src/twisted/conch/client/default.py, src/twisted/conch/client/knownhosts.py, src/twisted/conch/scripts/ckeygen.py, src/twisted/conch/scripts/conch.py
  • code-evalsrc/twisted/conch/insults/helper.py, src/twisted/conch/insults/insults.py, src/twisted/conch/recvline.py, src/twisted/internet/process.py, src/twisted/persisted/aot.py
  • code-execsrc/twisted/conch/scripts/cftp.py, src/twisted/conch/unix.py, src/twisted/internet/process.py, src/twisted/python/_release.py, src/twisted/python/release.py
  • code-networksrc/twisted/conch/scripts/ckeygen.py, src/twisted/conch/unix.py, src/twisted/internet/_multicast.py, src/twisted/internet/_resolver.py, src/twisted/internet/_signals.py

Source patterns

Patterns found in the source, including those malware is known to use.

  • capability-filesystem-delete
  • capability-filesystem-read
  • capability-filesystem-write-executable
  • capability-network-download
  • capability-network-outbound
  • capability-process-schedule
  • capability-process-spawn
  • threat-filesystem-read
  • threat-process-hooks
  • threat-runtime-environment-read
  • threat-runtime-system-info

Other checked releases

Check every dependency before it installs

This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.

Start free How it works