CVE-2026-7210

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Insufficient Entropy pada python. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-331: Insufficient Entropy

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 patch
• https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566 patch
• https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a patch
• https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f patch
• https://github.com/python/cpython/pull/149023 issue tracking · patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/ mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/05/11/13 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/05/11/8 mailing list · advisory pihak ketiga
• https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56
• https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b
• https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286
• https://github.com/python/cpython/issues/149018 issue tracking