CVE-2026-4224

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Uncontrolled Recursion pada python. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

Rincian

Terbit di NVD

16 Maret 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a patch
• https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785 patch
• https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee patch
• https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3 patch
• https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 patch
• https://github.com/python/cpython/pull/145987 patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/ advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/16/4 mailing list · advisory pihak ketiga
• https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621
• https://github.com/python/cpython/issues/145986 issue tracking