[<prev] [next>] [day] [month] [year] [list]
Message-ID: <bdda9b88-bf3b-4574-856e-8db3127c5cf3@oracle.com>
Date: Mon, 16 Mar 2026 15:00:32 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2026-4224] CPython Stack overflow parsing XML
with deeply nested DTD content models
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-4224] Stack overflow parsing XML with deeply nested DTD content models
Date: Mon, 16 Mar 2026 17:46:00 +0000
From: Stan Ulbrych via Security-announce <security-announce@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
CC: Stan Ulbrych <stanulbrych@...il.com>
There is a HIGH severity vulnerability
affecting CPython.
When an Expat parser with a registered ElementDeclHandler parses an inline
document type definition containing a deeply nested content model a C stack
overflow occurs.
Please see the linked CVE ID for the latest information on
affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-4224
* https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
