Executive brief
A vulnerability exists in Python's standard XML parsing libraries, which are used by many applications to process data. An attacker can send a specially crafted XML document to cause a 'hash flooding' attack, which consumes excessive system resources. This can lead to a denial-of-service (DoS) condition, making the affected application or service slow or completely unresponsive.
Technical details
The pyexpat and _elementtree modules in CPython use insufficient entropy (only 4 to 8 bytes) when calling XML_SetHashSalt to protect against hash-flooding attacks. This weakness allows an attacker to craft XML documents that cause hash collisions in the underlying Expat parser, leading to high CPU consumption and denial-of-service. The fix involves updating CPython to use the newer XML_SetHashSalt16Bytes API introduced in libexpat 2.8.0, which allows for 16 bytes of entropy. Full mitigation requires both patching CPython and ensuring the system is linked against libexpat 2.8.0 or later.
Affected products
- Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14
Timeline
- 2026-04-26: disclosed: Issue reported on CPython GitHub repository
- 2026-05-10: patched: Fix merged into CPython main branch
- 2026-05-11: advisory: Official security announcement published
References
- https://github.com/python/cpython/issues/149018
- https://github.com/python/cpython/pull/149023
- https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
- http://www.openwall.com/lists/oss-security/2026/05/11/13
- http://www.openwall.com/lists/oss-security/2026/05/11/8