CVE-2026-7210

EUVD-2026-29178
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 52.85%
Affected Products (NVD)
VendorProductVersion
pythonpython
𝑥
< 3.13.14
pythonpython
3.14.0 ≤
𝑥
< 3.14.6
pythonpython
3.15.0:alpha1
pythonpython
3.15.0:alpha2
pythonpython
3.15.0:alpha3
pythonpython
3.15.0:alpha4
pythonpython
3.15.0:alpha5
pythonpython
3.15.0:alpha6
pythonpython
3.15.0:alpha7
pythonpython
3.15.0:alpha8
pythonpython
3.15.0:beta1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pythoncpython
𝑥
< 3.13.14
CNA
pythoncpython
3.14.0 ≤
𝑥
< 3.14.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
python2.7
bullseye
vulnerable
python3.11
bookworm
no-dsa
bookworm (security)
vulnerable
python3.13
forky
3.13.14-1
fixed
sid
3.13.14-1
fixed
trixie
no-dsa
python3.14
forky
3.14.6-1
fixed
sid
3.14.6-1
fixed
python3.9
bullseye
postponed
bullseye (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python3.13
jammy
dne
noble
dne
questing
ignored
resolute
dne
python3.14
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
python2.7
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.10
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.11
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.12
jammy
dne
noble
needs-triage
questing
dne
resolute
dne
python3.4
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
python3.5
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.6
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.7
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.8
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.9
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpython3_10-1_0
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
libpython3_4m1_0
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
libpython3_4m1_0-32bit
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-base
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-curses
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-devel
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-tk
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python310
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-base
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
python310-curses
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-dbm
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-devel
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
python310-idle
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-tk
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-tools
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-unversioned-command
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-debug
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-devel
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-idle
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-libs
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-test
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-tkinter
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3.11
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debug
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debuginfo
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debugsource
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-devel
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-idle
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-libs
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-test
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-tkinter
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.12
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debug
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debuginfo
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debugsource
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-devel
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-idle
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-libs
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-test
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-tkinter
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.13
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debuginfo
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debugsource
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-devel
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-idle
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-libs
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-test
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-tkinter
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.14
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-debug
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-debuginfo
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-debugsource
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-devel
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-debug
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-devel
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-idle
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-libs
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-test
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-freethreading-tkinter
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-idle
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-libs
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-test
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.14-tkinter
Amazon Linux 2023
0:3.14.5-1.amzn2023.0.1
fixed
python3.9-debuginfo
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3.9-debugsource
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
Common Weakness Enumeration
References
https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4
https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566
https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a
https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f
https://github.com/python/cpython/issues/149018
https://github.com/python/cpython/pull/149023
https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
http://www.openwall.com/lists/oss-security/2026/05/11/13
http://www.openwall.com/lists/oss-security/2026/05/11/8