CVE-2026-7210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7210
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-7210.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-7210
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (10)
DEBIAN (1)
ECHO (1)
MINI (5)
OESA (5)
openSUSE (6)
RHSA (5)
ROOT (4)
SUSE (12)
UBUNTU (1)
Related
openSUSE (6)
SUSE (12)
Published
2026-05-11T17:19:09Z
Modified
2026-10-02T11:46:06Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
Details

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Database specific 
{
    "cna_assigner": "PSF",
    "cwe_ids": [
        "CWE-331"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7210.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.10.22"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
deaf509e8fc6e0363bd6f26d52ad42f976ec42f2
Fixed
41388c9cb160d0886d5ca00d2e6c8782608a4549
Introduced
0fb18b02c8ad56299d6a2910be0bab8ad601ef24
Fixed
2abcf904b8dac8c999d2b3aac76681abb333798a
Introduced
60403a5409ff2c3f3b07dd2ca91a7a3e096839c7
Fixed
fd17997c3866d61e0e7bd8201b1d8f35b40a40bd
Introduced
ebf955df7a89ed0c7968f79faec1de49f61ed7cb
Fixed
c63aec69bd59c55314c06c23f4c22c03de76fe45
Introduced
f31a89bb901067dd105b00cfa90523cf7ffdbbdd
Fixed
94a64bbc6ce89644cf02b82c723d9cc37f6a1870
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.11.0"
        },
        {
            "fixed": "3.11.16"
        },
        {
            "introduced": "3.12.0"
        },
        {
            "fixed": "3.12.14"
        },
        {
            "introduced": "3.13.0"
        },
        {
            "fixed": "3.13.14"
        },
        {
            "introduced": "3.14.0"
        },
        {
            "fixed": "3.14.6"
        },
        {
            "introduced": "3.15.0a1"
        },
        {
            "fixed": "3.15.0b2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.12.0
v3.12.1
v3.12.10
v3.12.11
v3.12.12
v3.12.13
v3.12.2
v3.12.3
v3.12.4
v3.12.5
v3.12.6
v3.12.7
v3.12.8
v3.12.9
v3.13.0
v3.13.1
v3.13.10
v3.13.11
v3.13.12
v3.13.13
v3.13.2
v3.13.3
v3.13.4
v3.13.5
v3.13.6
v3.13.7
v3.13.8
v3.14.0
v3.14.1
v3.14.2
v3.14.3
v3.14.4
v3.14.5
v3.14.5rc1
v3.15.0b1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-7210.json"