UpHeron
All vulnerabilities

Servers and applications

CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6,…

Severity
High 7.5
Published
25 Sept 2018
Last changed
7 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 2.7.0 up to 2.7.15
  • From 3.4.0 up to 3.4.9
  • From 3.5.0 up to 3.5.6
  • From 3.6.0 up to 3.6.6
  • Version 3.7.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-14647
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-14647