CVE-2026-7210: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.8.0 - Compensating control
Apply the Expat hash-flooding protection patch referenced for CVE-2026-7210 in addition to upgrading libexpat to 2.8.0 or later (fully mitigating requires both updating libexpat and applying this patch).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7210?
CVE-2026-7210 is considered a medium severity vulnerability due to the potential for denial-of-service through hash flooding.
How do I fix CVE-2026-7210?
To fix CVE-2026-7210, update to versions of affected software that are patched to increase entropy in hash functions.
Which software is impacted by CVE-2026-7210?
CVE-2026-7210 affects Python Software Foundation's CPython and Expat libexpat versions earlier than 2.8.0.
What is hash flooding in the context of CVE-2026-7210?
Hash flooding occurs when an attacker exploits poor hash function performance by sending specially crafted XML data that causes excessive collisions.
Can CVE-2026-7210 lead to system compromise?
CVE-2026-7210 does not lead to system compromise but can result in denial-of-service due to resource exhaustion.