BIT-python-2026-7210: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Published May 11, 2026

Updated

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Affected Software

2 affected components

Python Software Foundation Python

Expat libexpat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libexpat to a version that resolves this vulnerability.
Fixed in 2.8.0

Event History

May 11, 2026

CVE Published

via OSV·05:19 PM

Data Sourced

via OSV·05:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

An attacker needs to supply a crafted XML document to an application that parses it using xml.parsers.expat or xml.etree.ElementTree. The crafted document can trigger hash flooding in Expat.

What is required for full remediation?

Full mitigation requires updating libexpat to version 2.8.0 or later and applying the associated patch. Updating libexpat alone is not described as a complete mitigation.

BIT-python-2026-7210: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

What is required for full remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

What is required for full remediation?