PT-2026-39722 · Python+1 · Python+1

Stan Ulbrych · Published 2026-05-11 · Updated 2026-07-02 · CVE-2026-7210

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flooding protection. This allows a specially crafted XML document to trigger hash flooding, a condition where many keys are mapped to the same hash bucket, significantly slowing down processing.

Recommendations Update libexpat to version 2.8.0 or later and apply the available software patch.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

BIT-LIBPYTHON-2026-7210

BIT-PYTHON-2026-7210

BIT-PYTHON-MIN-2026-7210

CVE-2026-7210

ECHO-63FC-2F8A-5391

OPENSUSE-SU-2026:11101-1

OPENSUSE-SU-2026:11181-1

PSF-2026-23

Affected Products

Python

Libexpat

References · 46

• https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a · Patch
• https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566 · Patch
• https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f · Patch
• https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 · Patch
• https://github.com/python/cpython/pull/149023 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11101-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-7210 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7210 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-libpython-2026-7210 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7210 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-7210 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-23 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7210 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2026-7210 · Vendor Advisory