Description
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Problem types
Product status
Any version before 3.13.14
3.14.0 (python) before 3.14.6
3.15.0a1 (python) before 3.15.0b2
Credits
Stan Ulbrych (https://github.com/StanFromIreland)
Gregory P. Smith (https://github.com/gpshead)
References
www.openwall.com/lists/oss-security/2026/05/11/8
www.openwall.com/lists/oss-security/2026/05/11/13
mail.python.org/.../thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
github.com/python/cpython/pull/149023
github.com/python/cpython/issues/149018
github.com/...ommit/24b8f12544468e4cedf5bfbe25442fcd495391e4
github.com/...ommit/3573b3b1ecbd99030a0b18658e1bfece771b2566
github.com/...ommit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a
github.com/...ommit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f