Twisted, an event‑driven Python framework, allowed an attacker to deliver a forged UDP DNS response that matched a pending query’s transaction ID but came from an arbitrary source address because the framework did not validate the source host and port. The resultant injection could alter hostname resolution, leading to mail interception, server‑side request forgery, or man‑in‑the‑middle attacks. This weakness manifests as a DNS response spoofing flaw in twisted.names.dns.DNSDatagramProtocol.

The vulnerability exists in all Twisted releases prior to version 26.10.0rc1. Applications using twisted.names or the broader Twisted framework that rely on DNSDatagramProtocol for DNS resolution are affected.

The listed CVSS score of 3.1 indicates low severity. The EPSS score is not available, and the vulnerability is not yet in the CISA KEV catalog. However, because the flaw can be exploited remotely over standard DNS traffic, the potential impact on applications that reuse the DNSDatagramProtocol instance is significant. The likely attack vector is an off‑path attacker crafting a DNS response that matches a transaction ID, which is more difficult when using a new random source port per query, but still feasible. Given the absence of source address validation, the attack is relatively simple once the correct ID is guessed.