Twisted 認証前に遠隔からサービス停止される恐れ

Summary

An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.

Details

In ExpatElementStream._onStartElement, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:

# src/twisted/words/xish/domish.py  (ExpatElementStream._onStartElement)
if self.documentStarted == 1:
    if self.currElem != None:
        self.currElem.children.append(e)   # append child: no depth/count cap
        e.parent = self.currElem
    self.currElem = e                      # descend into the new element

An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport XmlStream.dataReceived feeds bytes to self.stream.parse(data) with no size limit, and in XMPP the stream is parsed during negotiation before authentication.

Affected product: Twisted, twisted.words.xish.domish element stream
Affected versions: confirmed against 26.…