`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Fix
Patch, vendor advisory and mitigation references on NVD 5
- https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 Patch
- https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566 Patch
- https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a Patch
- https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f Patch
- https://github.com/python/cpython/pull/149023 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.3 · pythonNVD modified 2026-10-26 18:10
Affected (CPE criteria) 10
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*
References 12
- https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 Patch
- https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566 Patch
- https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56
- https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b
- https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286
- https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a Patch
- https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f Patch
- https://github.com/python/cpython/issues/149018 Issue Tracking
- https://github.com/python/cpython/pull/149023 Issue Tracking, Patch
- https://mail.python.org/archives/list/[email protected]/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/ Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/11/13 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/11/8 Mailing List, Third Party Advisory