CVE-2026-115774

## Summary An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served. ## Details Meeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body: ```python # twisted/mail/imap4.py parseNestedParens literalSize = int(s[i + 1 : end]) # no sign check contentStack[-1].append((s[end + 3 : end + 3 + literalSize],)) i = end + 3 + literalSize # negative size -> i goes negative ``` `int(b"-100")` is `-100`, so `i` goes negative; the loop condition `i < len(s)` stays true and `s[i : i + 1]` on a negative index never raises, so the cursor cycles forever. The `_literalStringLimit` guard only covers the synchronizing-literal continuation path, not this inline branch. The call is reached from `select_SEARCH` through `arg_searchkeys`, dispatched only in the selected state, so a valid login and a selected mailbox (any low-privilege account) suffice. It runs in the reactor thread, and the connection timeout cannot fire because the reactor itself is frozen. Affected product: Twisted (`twisted.mail`), the IMAP4 server `twisted.mail.imap4.IMAP4Server` Affected versions: 26.4.0 and earlier ## PoC Log in, select a mailbox, and send a `SEARCH` whose literal size is negative: ```text C: t1 LOGIN testuser password-test C: t2 SELECT INBOX C: t3 SEARCH {-100}zzzzzzzzzz ``` The server never responds and one core stays at 100 percent. In a measured run