Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

CVE-2026-7210: XML Parsing Software May Crash from Malicious Data

CVE-2026-7210 BIT-libpython-2026-7210 BIT-python-2026-7210 PSF-2026-23 BIT-python-min-2026-7210
Summary

Some XML parsing software can be crashed by a specially designed XML file. This can happen if the software is not up to date, specifically if it's using an old version of the Expat library. To fix this, you should update the Expat library to the latest version and apply a patch if necessary.

What to do
  • Update python to version 3.14.6.
  • Update python-min to version 3.14.6.
  • Update libpython to version 3.14.6.
Affected software
Ecosystem VendorProductAffected versions
– python python < 3.15.0
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Bitnami – python >= 3.14.0, < 3.14.6
Fix: upgrade to 3.14.6
Bitnami – python-min >= 3.14.0, < 3.14.6
Fix: upgrade to 3.14.6
Bitnami – libpython >= 3.14.0, < 3.14.6
Fix: upgrade to 3.14.6
– libexpat_project libexpat < 2.8.0
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
Original title
The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
Original description
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
nvd CVSS4.0 6.3
Vulnerability type
CWE-331
Published: 5 Jun 2026 · Updated: 20 Jul 2026 · First seen: 11 May 2026