Twisted’s words.domish XML parser can allow an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser stores the unfinished stanza as an in‑memory tree with no byte or element limit. Because XMPP pre‑authentication stream parsing exposes this behavior, an attacker can initiate a connection and send data that causes the server to build an arbitrarily large tree, leading to memory exhaustion that terminates the process and denies service to all users. This flaw is classified as CWE‑400 and CWE‑770.

Any deployment of the Twisted framework for Python 3.6 or newer is affected, including applications that embed Twisted’s XMPP support. The vulnerability is fixed in Twisted version 26.10.0rc1, so all releases older than that are vulnerable.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is not available, but the lack of a publicly documented exploit in CISA KEV suggests no widespread active attacks yet. The flaw can be exploited by any unauthenticated peer that can open an XMPP stream to the server—no additional privileges are required. Once the attacker initiates the malformed stream, the server will consume memory until it crashes, disrupting service for all users. The high impact and remote nature warrant prompt remediation.