# CVE-2026-83813: Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

CVE-2026-83813 is fixed in twisted on 1 platform by DEBIAN-CVE-2026-83813 (version 26.10.0-1), released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-83813
- Priority: Routine
- CVSS: 3.1 (Low)
- EPSS: 0.0011
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026
- Weakness: Origin Validation Error
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83813

## Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | twisted Debian 14 | 26.10.0-1 | [DEBIAN-CVE-2026-83813](https://patchblox.com/security/data/fix/linux/debian-cve-2026-83813.md) | Nov 3, 2026 |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.