[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <82e499f9-6702-457b-8e11-7d2d588db44e@oracle.com>
Date: Mon, 11 May 2026 10:20:10 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2026-7210] Cpython: The expat and elementtree
parsers use insufficient entropy for XML hash-flooding protection
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-7210] The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
Date: Mon, 11 May 2026 17:58:49 +0100
From: Stan Ulbrych via Security-announce <security-announce@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
CC: Stan Ulbrych <stanulbrych@...il.com>
There is a MEDIUM severity vulnerability affecting CPython.
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.
Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-7210
* https://github.com/python/cpython/pull/149023
Best regards,
Stan Ulbrych.
_______________________________________________
Security-announce mailing list -- security-announce@...hon.org
To unsubscribe send an email to security-announce-leave@...hon.org
https://mail.python.org/mailman3//lists/security-announce.python.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
