PT-2026-25791 · Expat+2 · Expat+2

Bénédikt Tran + 2 · Published 2026-01-01 · Updated 2026-05-20 · CVE-2026-4224

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Expat (affected versions not specified)

Description The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALSA-2026:10950

ALSA-2026:19019

ALSA-2026:19064

ALSA-2026:19176

ALSA-2026:19177

BDU:2026-04602

BIT-LIBPYTHON-2026-4224

BIT-PYTHON-2026-4224

BIT-PYTHON-MIN-2026-4224

CVE-2026-4224

ECHO-7DC2-599B-22CD

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10469-1

OPENSUSE-SU-2026:10477-1

OPENSUSE-SU-2026:10478-1

OPENSUSE-SU-2026:10479-1

OPENSUSE-SU-2026:10480-1

OPENSUSE-SU-2026:10481-1

OPENSUSE-SU-2026:20517-1

PSF-2026-12

RHSA-2026:10950

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2026:1206-1

SUSE-SU-2026:1292-1

SUSE-SU-2026:1296-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

Affected Products

Expat

Red Os

Rocky Linux

References · 166

• https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785 · Patch
• https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee · Patch
• https://github.com/python/cpython/pull/145987 · Patch
• https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3 · Patch
• https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a · Patch
• https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 · Patch
• https://errata.almalinux.org/8/ALSA-2026-10950.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4224 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19064 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-4224 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-19177.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4224 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1899 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2026-4224 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-4224 · Vendor Advisory