[CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018
Description
Hi!
pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.
Thanks and best, Sebastian
CC #149017
Linked PRs
- gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible #149023 - [3.15] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149645 - [3.14] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #149646 - [3.13] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #151160 - [3.10] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #152188 - [3.12] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155345 - [3.11] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) (GH-155345) #155610 - [3.10] gh-149018: Use
XML_SetHashSalt16Bytesinpyexpat/_elementtreewhen possible (GH-149023) #155611
Activity
serhiy-storchaka commentedon Apr 26, 2026
Why call
XML_SetHashSaltif Expact by default uses high quality entropy ifXML_SetHashSaltwas not called? If we able to get high quality entropy for Expact, Expact is able to get it itself.The call of
XML_SetHashSaltwas added in 8e91cf6 (bpo-14234/gh-58442). cc @gpsheadStanFromIreland commentedon Apr 26, 2026
We don't vendor the necessary files, see this thread: #149020 (comment)
gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` w…
[-][security] Insufficient entropy in `pyexpat` with protection against hash flooding[/-][+][CVE-2026-7210] Insufficient entropy in `pyexpat` with protection against hash flooding[/+][3.15] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.14] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.13] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
sfc-gh-fwagner commentedon Jun 12, 2026
Hi,
CVE-2026-7210 lists the fixed version as 3.15.0 only. Could this be updated to include 3.14.6 and 3.13.14? The current range is causing false positives in scanners that rely on NVD CPE data.
Same issue applies to CVE-2026-6019 (gh-90309).
Thanks a lot!
bi49kote commentedon Jun 16, 2026
Totally agree with sfc-gh-fwagner - this would help a lot!
StanFromIreland commentedon Jun 16, 2026
Hmm, I thought it would be picked up automatically.
CC @sethmlarson
8 remaining items
Kanishk-Bansal commentedon Aug 6, 2026
any ETA for 3.12.14?
sethmlarson commentedon Aug 6, 2026
@Kanishk-Bansal As noted earlier in the thread, please see our security policy.
[3.12] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.11] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
[3.10] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…
hartwork commentedon Aug 13, 2026
Closing as complete…
package/python3: security bump to v3.12.14
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`
[CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`