Twisted 26.10.0rc2 Adds Python 3.14 Support and Resolves Seven Security Issues
The latest release of the Twisted framework introduces Python 3.14 compatibility, patches multiple critical security vulnerabilities, and removes long-deprecated code components.
Twisted 26.10.0rc2 published on October 26, 2026, adds Python 3.14 support and is the final release to support Python 3.10.
This build bundles fixes for seven security advisories, including six CVEs: CVE-2026-83813, CVE-2026-115778, CVE-2026-115775, CVE-2026-115877, CVE-2026-115774, and CVE-2026-115776, alongside GHSA-vpp8-g58w-m8mp. Conch limits subnegotiation data buffers to prevent memory exhaustion, while twisted.words.xish caps stanza byte size and element count. IRC lines have length limits, and twisted.mail.imap4.IMAP4Server rejects SEARCH commands containing literals with negative octet counts. The twisted.web HTTP/2 server limits stream reset speed to mitigate CVE-2023-44487, and HTTPChannel.headerReceived rejects header values with bare carriage returns or line feeds to prevent request smuggling. DNSDatagramProtocol.query now discards responses from unqueried hosts, and FTPClient defaults to passive data connections using the original server IP. Compared to rc1, this version adds one fix ensuring twisted.web.websocket.WebSocketResource and WebSocketClientEndpoint pass complete messages to textMessageReceived and bytesMessageReceived.
Python 3.14 lands alongside user code support for SO_REUSEPORT and SO_REUSEADDR TCP socket flags. Conch SSHServerTransport now supports the mlkem768x25519-sha256 hybrid post-quantum key exchange algorithm. Performance ticks up slightly, with awaiting a Deferred running 2-3% faster and chunked writes in twisted.web.http.Request.write gaining 12% speed.
Long-deprecated items are gone. twisted.internet.tcp.Connection drops support for dataReceived returning non-None values, PotentialZombieWarning is removed, and IProcessProtocol implementations must now provide processExited. Furthermore, ThreadedResolver and private _makeGetterFactory are gone, alongside several class attributes on twisted.names.dns.Message. New deprecations hit protocolNegotiationMechanisms, ProtocolNegotiationSupport, and twisted.trial.runner.samefile.