CVE-2026-115776

## Summary An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication. ## Details `IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`: ```python # twisted/words/protocols/irc.py class IRC(protocol.Protocol): # not a LineReceiver, so no MAX_LENGTH buffer = "" def dataReceived(self, data): if isinstance(data, bytes): data = data.decode("utf-8") lines = (self.buffer + data).split(LF) self.buffer = lines.pop() # no 3line feed -> whole input stays buffered ... ``` With no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required. Affected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser` Affected versions: 26.4.0 and earlier ## PoC On a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never c