Description

hartwork

opened on Apr 26, 2026

Issue body actions

Hi!

pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.

Thanks and best, Sebastian

CVE-2026-7210

CC #149017

Linked PRs

• gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible #149023
• [3.15] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149645
• [3.14] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149646
• [3.13] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #151160
• [3.10] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #152188
• [3.12] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #155345
• [3.11] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) (GH-155345) #155610
• [3.10] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #155611

Activity

1. picnixz

   added

   type-securityA security issueA security issue

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-XML

   on Apr 26, 2026
2. serhiy-storchaka commented on Apr 26, 2026

   

   serhiy-storchaka

   on Apr 26, 2026

   Member

   More actions

   Why call XML_SetHashSalt if Expact by default uses high quality entropy if XML_SetHashSalt was not called? If we able to get high quality entropy for Expact, Expact is able to get it itself.

   The call of XML_SetHashSalt was added in 8e91cf6 (bpo-14234/gh-58442). cc @gpshead
3. StanFromIreland

   assigned

   StanFromIreland

   and unassigned

   StanFromIreland

   on Apr 26, 2026
4. StanFromIreland commented on Apr 26, 2026

   

   StanFromIreland

   on Apr 26, 2026

   Member

   More actions

   Expact is able to get it itself.

   We don't vendor the necessary files, see this thread: #149020 (comment)
5. StanFromIreland

   added a commit that references this issue on May 10, 2026

   gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` w…

   24b8f12
6. hartwork

   changed the title [-][security] Insufficient entropy in `pyexpat` with protection against hash flooding[/-] [+][CVE-2026-7210] Insufficient entropy in `pyexpat` with protection against hash flooding[/+] on May 11, 2026
7. StanFromIreland

   added a commit that references this issue on May 24, 2026

   [3.15] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

   3573b3b
8. StanFromIreland

   added 2 commits that reference this issue on Jun 9, 2026

   [3.14] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

   eeea765

   [3.13] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

   fc9b11f
9. sfc-gh-fwagner commented on Jun 12, 2026

   

   sfc-gh-fwagner

   on Jun 12, 2026

   More actions

   Hi,

   CVE-2026-7210 lists the fixed version as 3.15.0 only. Could this be updated to include 3.14.6 and 3.13.14? The current range is causing false positives in scanners that rely on NVD CPE data.

   Same issue applies to CVE-2026-6019 (gh-90309).

   Thanks a lot!

   Reacted by Matt Copperwaite, adonbah, sjer-akamai, Andrey Bulava, sola-tron, bi49kote, jfastnetjets, Srinivas, Marcos Moyano, philipyzhang and 5 more
10. bi49kote commented on Jun 16, 2026

    

    bi49kote

    on Jun 16, 2026

    More actions

    Totally agree with sfc-gh-fwagner - this would help a lot!
11. StanFromIreland commented on Jun 16, 2026

    

    StanFromIreland

    on Jun 16, 2026

    Member

    More actions

    Hmm, I thought it would be picked up automatically.

    CC @sethmlarson
12. 10 remaining items
13. Yhg1s

    added a commit that references this issue on Aug 11, 2026

    [3.12] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

    e37df2a
14. pablogsal

    added 2 commits that reference this issue on Aug 12, 2026

    [3.11] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

    cbaecf9

    [3.10] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_element…

    ea70712
15. hartwork commented on Aug 13, 2026

    

    hartwork

    on Aug 13, 2026

    ContributorAuthor

    More actions

    Closing as complete…

    Reacted by Stan Ulbrych
16. hartwork

    closed this as completedon Aug 13, 2026
17. arnout

    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    80251a0
18. mcepl

    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    effa59a

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    75b663d

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    581ba0a

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    c17910b
19. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    dc1e6c9

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    51d7e13

    [CVE-2026-7210] Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree`

    f585c1d
20. icanhasmath

    added 2 commits that reference this issue on Oct 28, 2026

    pythongh-149018: Give Expat parsers a 16-byte random hash salt (CVE-2…

    fb66720

    [3.10] pythongh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_e…

    7eda8df

Issue actions