PSF-2026-23: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Q: What must be done to fully mitigate this issue?

Full mitigation requires both updating libexpat to version 2.8.0 or later and applying the patch. Updating only one of these components is not described as fully mitigating the vulnerability.

Q: What input is needed to trigger the problem?

An attacker needs to provide a crafted XML document that triggers hash flooding in xml.parsers.expat or xml.etree.ElementTree. The supplied data does not identify any authentication or user-interaction requirement.

Q: What is the expected impact of successful exploitation?

The provided severity vector indicates availability impact only, with low availability impact. It does not indicate confidentiality or integrity impact.

Published May 11, 2026

Updated

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Affected Software

2 affected components

Python Software Foundation Python

Expat Project libexpat<2.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libexpat to a version that resolves this vulnerability.
Fixed in 2.8.0

Event History

May 11, 2026

CVE Published

via OSV·05:19 PM

Data Sourced

via OSV·05:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must be done to fully mitigate this issue?

Full mitigation requires both updating libexpat to version 2.8.0 or later and applying the patch. Updating only one of these components is not described as fully mitigating the vulnerability.

What input is needed to trigger the problem?

An attacker needs to provide a crafted XML document that triggers hash flooding in xml.parsers.expat or xml.etree.ElementTree. The supplied data does not identify any authentication or user-interaction requirement.

What is the expected impact of successful exploitation?

The provided severity vector indicates availability impact only, with low availability impact. It does not indicate confidentiality or integrity impact.

PSF-2026-23: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Affected Software

Remediation

Event History

Frequently Asked Questions

What must be done to fully mitigate this issue?

What input is needed to trigger the problem?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must be done to fully mitigate this issue?

What input is needed to trigger the problem?

What is the expected impact of successful exploitation?