Repository navigation
[CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018
Description
Activity
Expact is able to get it itself.
We don't vendor the necessary files, see this thread: #149020 (comment)
- added a commit that references this issue
on May 10, 2026 - changed the title
[-][security] Insufficient entropy in `pyexpat` with protection against hash flooding[/-][+][CVE-2026-7210] Insufficient entropy in `pyexpat` with protection against hash flooding[/+]on May 11, 2026 - added a commit that references this issue
on May 24, 2026 Hi,
CVE-2026-7210 lists the fixed version as 3.15.0 only. Could this be updated to include 3.14.6 and 3.13.14? The current range is causing false positives in scanners that rely on NVD CPE data.
Same issue applies to CVE-2026-6019 (gh-90309).
Thanks a lot!
Reacted by Matt Copperwaite, adonbah, sjer-akamai, Andrey Bulava, sola-tron, bi49kote, jfastnetjets, Srinivas, Marcos Moyano, philipyzhang and 5 moreTotally agree with sfc-gh-fwagner - this would help a lot!
Hmm, I thought it would be picked up automatically.
CC @sethmlarson
8 remaining items
any ETA for 3.12.14?
@Kanishk-Bansal As noted earlier in the thread, please see our security policy.
- added a commit that references this issue
on Aug 11, 2026 Closing as complete…
Reacted by Stan Ulbrych- added a commit that references this issue
on Aug 14, 2026 - added 4 commits that reference this issue
on Sep 18, 2026
Hi!
pyexpat calls
XML_SetHashSaltwhich only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API functionXML_SetHashSalt16Bytesthat allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat callXML_SetHashSalt16Byteswhen compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.Thanks and best, Sebastian
CVE-2026-7210
CC #149017
Linked PRs
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible #149023XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149645XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149646XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #151160XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #152188XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155345XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) (GH-155345) #155610XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155611