The Twisted IMAP4 server can enter an infinite loop when an authenticated client issues a SEARCH command containing a negative literal size. The negative value causes Twisted’s parser cursor to move before the start of the buffer, and Python’s handling of negative indexes prevents the synchronous scanning loop from terminating. The loop blocks the single‑threaded reactor, halting all IMAP sessions and any SMTP or POP3 services running in the same process. The vulnerability does not directly compromise confidentiality or integrity; its effect is limited to availability through a self‑contained denial of service.

The flaw exists in the Twisted framework for Python, specifically the twisted.mail.imap4.IMAP4Server component. All Twisted versions prior to 26.10.0rc1 are affected. The issue requires Python 3.6 or later and an authenticated IMAP session in the selected mailbox state.

The CVSS score of 4.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated IMAP session, so an attacker needs valid credentials to reach the vulnerable state. Because the flaw is limited to a single process and no escalation or data exfiltration is possible, the immediate risk is service disruption rather than compromise. However, in environments where the IMAP server handles critical mail flows, the denial of service could be highly disruptive.