MEDIUM SeverityCVSS 4.06.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVE-2026-7210

Last updated May 11, 2026 · Published May 11, 2026

Description

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Affected products

1 listed

Python Software Foundation:CPython

Mappings

CWE

CWE-331

CAPEC

None listed.