Amazon Linux Addresses DoS Vulnerability in Python's Twisted Framework

A new security advisory, ALAS2023-2026-1734, has been published by AWS for Amazon Linux 2023, detailing an important Denial of Service (DoS) vulnerability within the `twisted.names` module of the `python-twisted` package. The vulnerability, tracked as CVE-2026-42304, makes systems susceptible to attacks where a remote, unauthenticated actor could exploit a weakness in DNS name decompression. Attackers can send crafted TCP DNS packets containing deeply chained compression pointers. This malicious input bypasses existing loop-prevention logic, causing the single-threaded Twisted reactor to consume excessive resources and ultimately hang the server. This effectively freezes the system and denies legitimate users access. To remediate this issue, Amazon Linux 2023 users are advised to update their `python-twisted` package by running `dnf update python-twisted --releasever 2023.11.20260526` or `dnf update --advisory ALAS2023-2026-1734 --releasever 2023.11.20260526`.