Twisted IMAP server vulnerability fixed in Ubuntu releases

A security vulnerability has been identified in the Twisted event-based networking framework, specifically affecting its IMAP server implementation. The flaw involves the mishandling of wildcard patterns during mailbox list commands, which can be exploited to consume excessive system resources.

Ubuntu has released security updates to address CVE-2026-106454 across multiple release cycles. This affects users running Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. The vulnerability requires the attacker to be an authenticated user to execute the malicious commands.

Technical details of CVE-2026-106454

• Defect Class: The vulnerability is a denial of service (DoS) caused by resource exhaustion through improper wildcard pattern processing.
• Attack Vector: An authenticated remote attacker can send specially crafted network traffic to the IMAP server to trigger the crash or resource spike.
• Affected Component: The issue is localized to the IMAP server implementation within the Twisted event-based framework.
• Fixed Versions: Patches are available in python3-twisted versions 26.4.0-4ubuntu0.1 (26.10), 25.5.0-5ubuntu0.2 (26.04 LTS), 24.3.0-1ubuntu0.3 (24.04 LTS), and 22.1.0-2ubuntu2.8 (22.04 LTS).

Why it matters

System administrators running mail servers or network services built on the Twisted framework must apply these updates to prevent authenticated users from disrupting service availability. Because Twisted is a foundational library for many Python-based internet applications, this fix is critical for maintaining the stability of networked services on Ubuntu-based infrastructure.