Skip to content

[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363

Closed
Closed
[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210)#144363
Assignees
StanFromIreland
Labels
3.10 (EOL)end of life3.11only security fixesextension-modulesC modules in the Modules dirtopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Jan 31, 2026

Bug report

Bug description:

Hello! 👋

Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210).

The CPython issue for previous 2.7.3 was #139312 and the related merged main pull request was #139319, in case you want to have a look. (The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)

Thanks in advance!

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

Activity

  1. miss-islington
    added 2 commits that reference this issue on Feb 5, 2026

    pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-144365)

    90e913e

    pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-144365)

    59e114f
  2. encukou
    added a commit that references this issue on Feb 5, 2026

    pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)

    aa549fb
  3. StanFromIreland
    added 2 commits that reference this issue on Feb 5, 2026

    [3.11] pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-14…

    cd73060

    [3.10] pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-14…

    d3d13af
  4. StanFromIreland
    removed
    3.15bugs and security fixes
    on Feb 7, 2026
  5. encukou
    added 2 commits that reference this issue on Feb 9, 2026

    [3.14] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (GH-14…

    2e3f014

    [3.13] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (GH-14…

    7fbdec4
  6. StanFromIreland
    removed
    3.13only security fixes
    3.14bugs and security fixes
    on Feb 13, 2026
  7. thunder-coding
    added a commit that references this issue on Feb 15, 2026

    pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)

    b3ae6c7
  8. Yhg1s
    added a commit that references this issue on Feb 23, 2026

    [3.12] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144501)

    1899a02
  9. StanFromIreland
    removed
    3.12only security fixes
    on Feb 28, 2026
  10. pablogsal
    added 2 commits that reference this issue on Mar 2, 2026

    [3.11] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144514)

    d1475b5

    [3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144515)

    384afdd
  11. StanFromIreland
    closed this as completedon Mar 3, 2026
  12. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)

    49dc88f
  13. icanhasmath
    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-14…

    89729bb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixesextension-modulesC modules in the Modules dirtopic-XMLtype-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions