Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Summary

An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The twistd words server inherits the method unchanged through IRCUser, and the data is buffered before any authentication.

Details

IRC.dataReceived keeps everything up to the last line feed in self.buffer:

# twisted/words/protocols/irc.py
class IRC(protocol.Protocol):        # not a LineReceiver, so no MAX_LENGTH
    buffer = ""
    def dataReceived(self, data):
        if isinstance(data, bytes):
            data = data.decode("utf-8")
        lines = (self.buffer + data).split(LF)
        self.buffer = lines.pop()    # no 3line feed -> whole input stays buffered
        ...

With no line feed in the data, lines.pop() returns the entire accumulated content to self.buffer, so it grows by every chunk and is never bounded; IRC defines no MAX_LENGTH, no lineLengthExceeded, and no timeout, so the connection is never closed. The twistd words server protocol IRCUser subclasses IRC without overrid…