Repository navigation
[CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018
Description
Hi!
pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.
Thanks and best, Sebastian
CC #149017
Linked PRs
- gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible #149023 - [3.15] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149645 - [3.14] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149646 - [3.13] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #151160 - [3.10] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #152188 - [3.12] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155345 - [3.11] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) (GH-155345) #155610 - [3.10] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155611
Activity
v0.9.0: address PR#27 Codex P2 — pyexpat wrapper (CVE-2026-7210) two-…
v0.9.0: map CVE-2026-41080 (hash-flooding) into the posture map (#27)
tomcruiseqi commentedon Jun 25, 2026
3.10 backport has been pending since the 3.13 backport landed. Would you be OK with me helping prepare the 3.10 PR based on #152188, or is it still blocked by another dependency?
StanFromIreland commentedon Jun 25, 2026
It and 3.11/3.12 are still blocked by #151401. Are you preparing backports as a distributor? In that case I suggest you patch yourselves instead, there is no guarantee as to when we will manage to do so (see our security policy for more information).
I see you also opened other backports that come cleanly from ones, I would ask you please avoid doing that in the future. It increases the amount of PRs we have to review, as we have no guarantee it actually backported cleanly in your case.
twangboy commentedon Jun 25, 2026
I realize you're busy, and python 3.10 is whenever you decide to do it. Please expedite this.
StanFromIreland commentedon Jun 25, 2026
As documented in our security policy, distributors are responsible for patching themselves.
Kanishk-Bansal commentedon Aug 5, 2026
Is a backport for CVE-2026-7210 planned on 3.12?
Also, is 3.12.14 expected to include all the changes merged yesterday into 3.12 master for the CVE fixes?
CC @hartwork
hartwork commentedon Aug 5, 2026
@Kanishk-Bansal comment #149018 (comment) above seems related but #151401 seems to be merged by now.
I would assume so, yes, but I may be wrong.
Kanishk-Bansal commentedon Aug 6, 2026
any ETA for 3.12.14?
sethmlarson commentedon Aug 6, 2026
@Kanishk-Bansal As noted earlier in the thread, please see our security policy.
[3.12] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.11] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.10] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
hartwork commentedon Aug 13, 2026
Closing as complete…
package/python3: security bump to v3.12.14
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`