The vulnerability is an unbounded buffer that grows when a telnet client sends a sequence of bytes after IAC SB before the terminating IAC SE. Because telnet negotiation happens before authentication, an unauthenticated attacker can keep writing data and cause the process to consume all available memory, eventually crashing the service and potentially all applications that run on the same host. The flaw is a classic denial‑of‑service weakness caused by uncontrolled input length.

Twisted, versions prior to 26.10.0rc1. The flaw exists in the Twisted conch Telnet transport used by any application that imports twisted.conch.telnet.Telnet. Any deployment that provides telnet access without authentication—such as infrastructure management tools or custom Python services—will be affected as long as Twisted remains at a state before the 26.10.0rc1 release.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so current exploit probability is unknown, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is network‑based: a remote telnet client can send data without needing credentials. Because the buffer growth is unbounded and occurs before authentication, an attacker can trigger the denial of service immediately once a telnet connection is established.