{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-7210","sourceIdentifier":"cna@python.org","published":"2026-05-11T18:16:42.413","lastModified":"2026-10-26T18:10:00.173","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},{"lang":"es","value":"’xml.parsers.expat’ y ’xml.etree.ElementTree’ usan entropía insuficiente para la protección contra inundación de hash de Expat, lo que permite que un documento XML manipulado desencadene una inundación de hash.\n\nMitigar completamente esta vulnerabilidad requiere tanto actualizar libexpat a la versión 2.8.0 o posterior como aplicar este parche."}],"affected":[{"source":"cna@python.org","affectedData":[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["xml","expat"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.10.22","versionType":"python","status":"affected"},{"version":"3.11.0","lessThan":"3.11.16","versionType":"python","status":"affected"},{"version":"3.12.0","lessThan":"3.12.14","versionType":"python","status":"affected"},{"version":"3.13.0","lessThan":"3.13.14","versionType":"python","status":"affected"},{"version":"3.14.0","lessThan":"3.14.6","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b2","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@python.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-11T18:53:57.884366Z","id":"CVE-2026-7210","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@python.org","type":"Secondary","description":[{"lang":"en","value":"CWE-331"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionEndExcluding":"3.13.14","matchCriteriaId":"16DAC42F-7128-49F8-B799-78D78580EC70"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14.0","versionEndExcluding":"3.14.6","matchCriteriaId":"D93FC4C6-3E17-4FFD-97A5-7BAFACDCAF51"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"A3327507-0B1D-4F28-A983-D07A2C8A7696"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*","matchCriteriaId":"C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*","matchCriteriaId":"24CF56B0-2F4E-42A2-B655-F493AA0A4815"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*","matchCriteriaId":"7184ABBA-B100-489E-B5C1-1C9EEC0546CA"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*","matchCriteriaId":"B6D4181B-3E1B-499B-AAB1-50868A6A6AD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*","matchCriteriaId":"A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*","matchCriteriaId":"8C46C55C-801E-4F86-B669-8E6A12B4AB6F"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*","matchCriteriaId":"5A8DF8E5-61F9-4899-BF40-41A17E223441"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*","matchCriteriaId":"B678A5A5-99CA-45B6-BB73-FB0BD2F7B9A3"}]}]}],"references":[{"url":"https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","source":"cna@python.org","tags":["Patch"]},{"url":"https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","source":"cna@python.org","tags":["Patch"]},{"url":"https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","source":"cna@python.org","tags":["Patch"]},{"url":"https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","source":"cna@python.org","tags":["Patch"]},{"url":"https://github.com/python/cpython/issues/149018","source":"cna@python.org","tags":["Issue Tracking"]},{"url":"https://github.com/python/cpython/pull/149023","source":"cna@python.org","tags":["Issue Tracking","Patch"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","source":"cna@python.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}