CVE-2026-4224: Stack overflow parsing XML with deeply nested DTD content models
Last updated 10 September 2026
Other sources
Stack overflow parsing XML with deeply nested DTD content models
— Microsoft
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.19-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.14-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2Fixed in 7.3.23+dfsg-2 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.15-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.7-3Fixed in 3.14.7-4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4224?
CVE-2026-4224 has a high severity due to its potential to cause a stack overflow in applications using the Expat parser.
How do I fix CVE-2026-4224?
To fix CVE-2026-4224, you should upgrade to the latest version of Python CPython that includes the patch addressing this vulnerability.
What causes CVE-2026-4224?
CVE-2026-4224 is caused by a stack overflow that occurs when an Expat parser processes an inline document type definition with deeply nested content models.
Which versions of Python CPython are affected by CVE-2026-4224?
CVE-2026-4224 affects versions of Python CPython that utilize the Expat parser without the necessary safeguards against deep nesting in DTD content models.
Is CVE-2026-4224 exploitable remotely?
Yes, CVE-2026-4224 is remotely exploitable if an attacker can craft a malicious XML document that triggers the stack overflow.