# CVE-2026-7210: Python CPython denial of service in XML parsers

Source: https://junglewise.ai/threats/cve-2026-7210-python-cpython-denial-of-service-in-xml-parsers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-7210 · Severity: critical · CVSS 9.8 · Published 2026-05-11

A vulnerability exists in Python's standard XML parsing libraries, which are used by many applications to process data. An attacker can send a specially crafted XML document to cause a 'hash flooding' attack, which consumes excessive system resources. This can lead to a denial-of-service (DoS) condition, making the affected application or service slow or completely unresponsive.

Technologies: [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat), [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project), [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-7210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7210 being exploited in the wild.

**How severe is CVE-2026-7210?** Critical severity, with a CVSS score of 9.8, published 11 May 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.

**Is there a fix for CVE-2026-7210?** A patch was published on 2026-05-10: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7210 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7210?** Check whether you run Libexpat Project Libexpat or Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The pyexpat and _elementtree modules in CPython use insufficient entropy (only 4 to 8 bytes) when calling XML_SetHashSalt to protect against hash-flooding attacks. This weakness allows an attacker to craft XML documents that cause hash collisions in the underlying Expat parser, leading to high CPU consumption and denial-of-service. The fix involves updating CPython to use the newer XML_SetHashSalt16Bytes API introduced in libexpat 2.8.0, which allows for 16 bytes of entropy. Full mitigation requires both patching CPython and ensuring the system is linked against libexpat 2.8.0 or later.

## Affected products

- Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14

## Timeline

- 2026-04-26: disclosed: Issue reported on CPython GitHub repository
- 2026-05-10: patched: Fix merged into CPython main branch
- 2026-05-11: advisory: Official security announcement published

## References

- [https://github.com/python/cpython/issues/149018](https://github.com/python/cpython/issues/149018)
- [https://github.com/python/cpython/pull/149023](https://github.com/python/cpython/pull/149023)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/](https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/)
- [http://www.openwall.com/lists/oss-security/2026/05/11/13](http://www.openwall.com/lists/oss-security/2026/05/11/13)
- [http://www.openwall.com/lists/oss-security/2026/05/11/8](http://www.openwall.com/lists/oss-security/2026/05/11/8)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)