VULNERABILITY INTELLIGENCE

CVE-2026-7210

CVSS score6.3 MEDIUM
EPSS probability0.67%
CISA KEVNot currently listed
Published2026-05-11
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Weakness classification

  • CWE-331: Insufficient Entropy

Primary references