CVE-2026-7210
Full vulnerability record from the local CVENow database.
Description
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2026-05-11 18:16:42.413000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-7210",
"sourceIdentifier": "[email protected]",
"published": "2026-05-11T18:16:42.413",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."
},
{
"lang": "es",
"value": "’xml.parsers.expat’ y ’xml.etree.ElementTree’ usan entropía insuficiente para la protección contra inundación de hash de Expat, lo que permite que un documento XML manipulado desencadene una inundación de hash.\n\nMitigar completamente esta vulnerabilidad requiere tanto actualizar libexpat a la versión 2.8.0 o posterior como aplicar este parche."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Python Software Foundation",
"product": "CPython",
"defaultStatus": "unaffected",
"modules": [
"xml",
"expat"
],
"repo": "https://github.com/python/cpython",
"versions": [
{
"version": "0",
"lessThan": "3.10.22",
"versionType": "python",
"status": "affected"
},
{
"version": "3.11.0",
"lessThan": "3.11.16",
"versionType": "python",
"status": "affected"
},
{
"version": "3.12.0",
"lessThan": "3.12.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.13.0",
"lessThan": "3.13.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.14.0",
"lessThan": "3.14.6",
"versionType": "python",
"status": "affected"
},
{
"version": "3.15.0a1",
"lessThan": "3.15.0b2",
"versionType": "python",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-11T18:53:57.884366Z",
"id": "CVE-2026-7210",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-331"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.13.14",
"matchCriteriaId": "16DAC42F-7128-49F8-B799-78D78580EC70"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.14.0",
"versionEndExcluding": "3.14.6",
"matchCriteriaId": "D93FC4C6-3E17-4FFD-97A5-7BAFACDCAF51"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*",
"matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*",
"matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*",
"matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*",
"matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*",
"matchCriteriaId": "5A8DF8E5-61F9-4899-BF40-41A17E223441"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B678A5A5-99CA-45B6-BB73-FB0BD2F7B9A3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/issues/149018",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://github.com/python/cpython/pull/149023",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://mail.python.org/archives/list/[email protected]/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/",
"source": "[email protected]",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/11/13",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/11/8",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}
]
}