UpHeron
All vulnerabilities

Servers and applications

CVE-2026-7210

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Severity
Medium 6.3
Published
11 May 2026
Last changed
2 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.13.14, 3.14.6
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-beta1
  • Version 3.15.0-alpha8
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha6
All 11 release lines
  • Every version before 3.13.14
  • From 3.14.0 before 3.14.6
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha8
  • Version 3.15.0-beta1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-7210
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7210