Skip to main content

CPython EUVDEUVD-2026-29178

| CVE-2026-7210 MEDIUM
Insufficient Entropy (CWE-331)
2026-05-11 PSF GHSA-wxv8-w48j-r2f4
Information Disclosure Cpython Python Software Foundation
6.3
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Craft XML with hash-colliding element names
  2. Delivery
    Send XML to application parsing endpoint
  3. Exploit
    Parser loads XML into memory
  4. Install
    Hash collisions trigger O(n) complexity in Expat tables
  5. C2
    CPU/memory exhaustion
  6. Execute
    Application hangs
  7. Impact
    Denial of service

Vulnerability Assessment

Weakness
CWE
CWE-331
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Entropy requirements
Exploitation Conditions

Exploitation requires: (1) A Python application that parses XML from an untrusted or partially-controlled source using xml.parsers.expat or xml.etree.ElementTree, (2) CPython compiled against libexpat version prior to 2.8.0, (3) Network or local access to provide the malicious XML document to the parser, and (4) The attacker's ability to construct hash-colliding element names for the specific libexpat version in use (non-default attack knowledge required). No authentication is required (PR:N per CVSS vector). Exploitation is NOT possible if: (1) CPython is patched and libexpat is updated to 2.8.0+, (2) The application parses only trusted/pre-validated XML, (3) The application uses alternative XML libraries (not Expat-based), or (4) Sufficient resource limits are enforced to cap parser execution time and memory. The high attack complexity (AC:H) means exploitation demands specialized knowledge of Expat internals or pre-computed collision sets.
Impact

CVSS 6.3 with AV:N/AC:H reflects network-accessible exploitation requiring high attack complexity - the attacker must craft a specially-designed XML document whose element names and structure precisely collide within Expat's hash tables to trigger algorithmic complexity. The CVSS vector shows VA:L (low availability impact), confirming denial-of-service severity rather than data breach. The H in AC:H (high complexity) is the critical mitigating factor: hash flooding is not trivial to exploit - it requires either reverse-engineering Expat's hash function or pre-computing colliding inputs for specific libexpat versions. No KEV listing or public POC identified in provided data, suggesting this is a theoretical but credible threat rather than actively exploited. The Tags field lists 'Information Disclosure' but the CVSS vector shows no confidentiality impact (VC:N/VI:N), suggesting tag may be mislabeled or refers to hash-function leakage rather than data exfiltration. Real-world risk depends on deployment: Python applications parsing untrusted XML (web services, data import pipelines) face genuine DOS risk; applications processing trusted/validated XML face lower risk. The requirement for both libexpat 2.8.0 AND CPython patch application indicates fragmented remediation - systems with only one fix applied remain vulnerable.
Exploit ScenarioDerived

An attacker crafts a malicious XML document with element names designed to hash-collide within Expat's internal hash tables. The attacker sends this XML to a Python web application (e.g., via HTTP POST to an API endpoint that parses XML). When xml.parsers.expat or xml.etree.ElementTree parses the document, the hash collisions cause the parser to degrade from O(1) average-case to O(n) worst-case complexity per element, consuming excessive CPU and memory. The application becomes unresponsive, denying service to legitimate users. Success requires reverse-engineering the specific hash function parameters of the target libexpat version and crafting collisions accordingly - feasible but non-trivial, explaining the AC:H rating.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flooding protection, allowing crafted XML documents to trigger algorithmic complexity attacks (hash flooding) that degrade parser performance. Remote attackers can exploit this with complex XML payloads to cause denial of service. Mitigation requires both updating libexpat to 2.8.0 or later and applying the CPython patch, as confirmed by Python Software Foundation security advisory.

RemediationAI

Primary mitigation requires a two-part fix: (1) Update libexpat to version 2.8.0 or later (verify via pkg-config --modversion expat or equivalent for your platform), and (2) Apply the CPython patch (PR #149023 at https://github.com/python/cpython/pull/149023) and rebuild CPython from source. The patch is intended for the next CPython release; users of older releases should monitor their Python distribution or backport the changes manually. The patch adds XML_SetHashSalt16Bytes calls in Modules/_elementtree.c and Modules/pyexpat.c with fallback to legacy SetHashSalt if older libexpat is detected, ensuring compatibility. Binary distributions (e.g., from conda, apt, brew) will require waiting for distributors to rebuild CPython against libexpat 2.8.0 and include the patch - check your distribution's security advisories. As a temporary compensating control pending patching, restrict untrusted XML parsing to offline/batch processes with resource limits (set process memory and CPU timeouts via ulimit or cgroups), or use schema validation to reject pathologically complex documents before parsing. These controls reduce but do not eliminate DOS risk.

Affected VersionsENISA

CPython 0 <3.15.0

Affected Packages

euvd cpython fix: 3.15.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability stems from CWE-331 (Insufficient Entropy) in the hash salt generation for Expat's internal hash table protection mechanism. CPython's xml.parsers.expat and xml.etree.ElementTree modules wrap libexpat's XML parser and previously used only 8 bytes of entropy (or less in some configurations) for the XML_SetHashSalt API, which is insufficient to resist modern hash-flooding attacks. The fix increases entropy to 16 bytes by leveraging libexpat 2.8.0's new XML_SetHashSalt16Bytes API that accepts full 16-byte entropy, while maintaining backward compatibility with older libexpat versions via fallback to the legacy 8-byte SetHashSalt method. The CPython patch modifies pycore_pyhash.h to allocate full 16-byte storage for the XML hash salt and updates the PyExpat_CAPI struct to expose the SetHashSalt16Bytes function pointer, with conditional compilation ensuring graceful degradation on older libexpat versions.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
CVSS changed
May 11, 2026 - 18:22 NVD
6.3 (MEDIUM)
CVE Published
May 11, 2026 - 17:19 nvd
MEDIUM 6.3

DescriptionCVE.org

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-115557 CRITICAL
9.4 Oct 24

CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-114583 MEDIUM
6.9 Oct 22

CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi

Same weakness CWE-331 – Insufficient Entropy

View all
CVE-2025-47781 CRITICAL POC
9.8
CVE-2025-67504 CRITICAL POC
9.8
CVE-2020-36925 CRITICAL POC
9.8
CVE-2023-49599 CRITICAL POC
9.8
CVE-2024-36400 CRITICAL POC
9.8
CVE-2022-34294 CRITICAL POC
9.8
CVE-2020-12735 CRITICAL POC
9.8
CVE-2026-71851 CRITICAL POC
9.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/149023 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-7210 ADVISORY https://vuldb.com/vuln/362700 REF http://www.openwall.com/lists/oss-security/2026/05/11/13 REF http://www.openwall.com/lists/oss-security/2026/05/11/8 REF https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 REF https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566 REF https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56 REF https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b REF https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286 REF https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a REF https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f REF https://github.com/python/cpython/issues/149018

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy