ALAS2023-2026-3385

References: CVE-2026-115775  CVE-2026-115776  CVE-2026-115778 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in Twisted. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the XML stream parser retains unfinished elements in memory without enforcing size or element count limits. By transmitting a continuous stream of child elements within an unclosed container during pre-authentication communication, an attacker can crash the server process. (CVE-2026-115775)

A flaw was found in Twisted. The Internet Relay Chat (IRC) protocol implementation does not enforce a maximum line length when buffering incoming connection data. An unauthenticated remote attacker can exploit this by sending a continuous stream of data without line feed characters to an IRC service. This causes the server process to consume excessive memory until it runs out of resources, resulting in a Denial of Service (DoS) that terminates connections for all users. (CVE-2026-115776)

A flaw was found in Twisted. The Telnet service implementation fails to enforce a size limit on incoming data buffers during protocol option negotiation, which occurs before user authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of subnegotiation data without a terminating delimiter. This causes unbounded memory consumption that can crash the application, resulting in a Denial of Service (DoS). (CVE-2026-115778)

Issue Correction:
Run dnf update python-twisted --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3385 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

noarch:
    python3-twisted+tls-22.4.0-129.amzn2023.0.7.noarch
    python3-twisted-22.4.0-129.amzn2023.0.7.noarch

src:
    python-twisted-22.4.0-129.amzn2023.0.7.src