There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and
    earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards
    but passes all other characters from an authenticated client's LIST or LSUB pattern directly to
    re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic
    backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded
    reactor, the blocking match suspends all server input and output for the duration of the match. No fixed
    release is available as of this review. (CVE-2026-106454)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  Twisted 是基于事件的框架，适用于支持 Python 3.6+ 的 Internet 应用程序。在和更旧版本中 25.5.0 ，twisted/mail/imap4.py 中的 wildcardToRegexp（） 会转换 IMAP 星号和百分比通配符，但将经身份验证客户端的 LIST 或 LSUB 模式中的所有其他字符直接传送至 re.compile（），进而允许嵌套或其他占用大量时间的正则表达式构造在与邮箱名称匹配时造成灾难性回溯。由于 Twisted 使用协同的单线程反应堆，blocking 匹配会在匹配期间暂停所有服务器输入和输出。截至本次审查，尚无可用的修复版本。（CVE-2026-106454）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  Twisted 是適用於網際網路應用程式的事件型框架，支持 Python 3.6+。在 25.5.0 和之前，twisted/mail/imap4.py 中的 wildcardToRegexp（） 會轉換 IMAP 星號和百分比萬用字元，但會將所有其他字元從已驗證用戶端的 LIST 或 LSUB 模式直接傳遞至 re.compile（），從而允許巢狀或其他昂貴的規則運算式結構在與信箱名稱比對時造成災難性的回溯。因為 Twisted 使用合作的單執行緒反應器，所以封鎖比對會在比對期間暫停所有伺服器輸入和輸出。截至本次審查時，沒有可用的固定版本。（CVE-2026-106454）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Twisted は、Python 3.6+ をサポートする、イベントベースのインターネットアプリケーション用フレームワークです。25.5.0以前では、twisted/mail/imap4.py のwildcardToRegexp()はIMAPのアスタリスクとパーセントのワイルドカードを変換しますが、認証されたクライアントのLISTまたはLSUBパターンの他のすべての文字を直接re.compile()に渡します。これにより、ネスト化された、またはその他の高価な正規表現構造が、メールボックス名と一致したときに壊滅的なバックトラッキングを引き起こす可能性があります。Twisted は協調的なシングルスレッド リアクターを使用するため、ブロッキング マッチでは、マッチの期間中、すべてのサーバーの入出力が中断されます。このレビューの時点で利用可能な修正済みリリースはありません。(CVE-2026-106454)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5215-1 advisory.

    - CVE-2026-83813: DNS spoofing in `twisted.names` due to missing source address validation (bsc#1287833).
    - CVE-2026-106454: ReDoS due to improper use of `re.compile()` in `wildcardToRegexp()` (bsc#1284420).
    - CVE-2026-115774: denial of service via negative size in IMAP search command (bsc#1287671).
    - CVE-2026-115775: denial of service via memory exhaustion in XML stream parser (bsc#1287675).
    - CVE-2026-115776: denial of service via unbounded IRC buffer (bsc#1287676).
    - CVE-2026-115778: denial of service via memory exhaustion during Telnet negotiation (bsc#1287678).
    - CVE-2026-115877: HTTP request smuggling due to improper header delimiter handling (bsc#1287848).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-9000-1 advisory.

    It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An     authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources,     leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and     earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards     but passes all other characters from an authenticated client's LIST or LSUB pattern directly to     re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic     backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded     reactor, the blocking match suspends all server input and output for the duration of the match. No fixed     release is available as of this review. (CVE-2026-106454)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
473712	SCA: security update for Twisted (GHSA-8pqf-f4m5-798g)	Tenable Cloud Security	SCA Checks	2026/10/7	2026/10/7	medium
478037	Chainguard: synapse: security update to 1.164.1-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/10/31	2026/10/31	medium
473712	SCA: security update for Twisted (GHSA-8pqf-f4m5-798g)	Tenable Self-Hosted Container Security	SCA Checks	2026/10/7	2026/10/7	medium
478037	Chainguard: synapse: security update to 1.164.1-r2	Tenable Cloud Security	Chainguard Local Security Checks	2026/10/31	2026/10/31	medium
371387	Linux Distros 未修补的漏洞：CVE-2026-106454	Nessus	Misc.	2026/10/23	2026/11/5	medium
371387	Linux Distros 未修補弱點：CVE-2026-106454	Nessus	Misc.	2026/10/23	2026/11/5	medium
371387	Linux Distros のパッチ未適用の脆弱性: CVE-2026-106454	Nessus	Misc.	2026/10/23	2026/11/5	medium
381002	SUSE SLED15: python311-Twisted / python311-Twisted-all_non_platform / etc (SUSE-SU-2026:5215-1)	Nessus	SuSE Local Security Checks	2026/11/14	2026/11/14	high
376525	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Twisted vulnerability (USN-9000-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	medium
371387	Linux Distros Unpatched Vulnerability : CVE-2026-106454	Nessus	Misc.	2026/10/23	2026/11/5	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

high

medium

medium