CVE-2026-7210

highpriority · track · 30EPSS 0.007 · 51 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.67% (51st) EPSS

CVSS 7.5 · high

Is it mine?

32 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-23

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.7–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v4.06.3mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.06.3mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@python.org

v4.01.7lowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-331US

affected products (32)

Products and version ranges known to be affected.

IBM AIX 7.3all versionscert_bundDEcpe:/o:ibm:aix:7.3
IBM SPSSall versionscert_bundDEcpe:/a:ibm:spss:modeler
IBM VIOS 4.1all versionscert_bundDEcpe:/a:ibm:vios:4.1
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
IBM Concert< 3.0.1.1cert_bundDE
Open Source Python≤ CPython <2.8.0cert_bundDE
Python Software Foundation CPython0 → 3.11.16enisa_euvdEU
Python Software Foundation CPython3.12.0 → 3.12.14enisa_euvdEU
Python Software Foundation CPython3.13.0 → 3.13.14enisa_euvdEU
Python Software Foundation CPython3.14.0 → 3.14.6enisa_euvdEU
Python Software Foundation CPython3.15.0a1 → 3.15.0b2enisa_euvdEU
python python< 3.13.14nvdUScpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python3.14.0 → 3.14.6nvdUScpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python= 3.15.0nvdUScpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Bitnami libpython< 3.10.22osvUSpkg:bitnami/libpython
Bitnami libpython3.11.0 → 3.11.16osvUSpkg:bitnami/libpython
Bitnami libpython3.12.0 → 3.12.14osvUSpkg:bitnami/libpython

showing 20 of 32

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1472CPython: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-05-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CPython ausnutzen, um einen Denial of Service Angriff durchzuführen.
BIT-libpython-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection2026-06-05vendor · osvUS
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
BIT-python-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection2026-06-05vendor · osvUS
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
BIT-python-min-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection2026-06-05vendor · osvUS
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
PSF-2026-232026-05-11vendor · osvUS
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

also known as (7)

Other names and identifiers for this entity.

CNNVD-202605-2219 cnnvd
EUVD-2026-29178 enisa_euvd
GHSA-wxv8-w48j-r2f4 enisa_euvd
BIT-libpython-2026-7210osv
BIT-python-2026-7210osv
BIT-python-min-2026-7210osv
PSF-2026-23osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2026-05-11modified 2026-08-14

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan