HighFix available

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Type: advisorySource: OSV1 source record

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Announced 5 Jun 2026Group revision 1

Original source ↗

BIT-python-2026-7210

Primary source · Revision 3

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-python-2026-7210

python

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 3.10.22
Source reference: /affected/0/ranges
3.11.16
Source reference: /affected/0/ranges
3.12.14
Source reference: /affected/0/ranges
3.13.14
Source reference: /affected/0/ranges
3.14.6
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.10.22"
          },
          {
            "introduced": "3.11.0"
          },
          {
            "fixed": "3.11.16"
          },
          {
            "introduced": "3.12.0"
          },
          {
            "fixed": "3.12.14"
          },
          {
            "introduced": "3.13.0"
          },
          {
            "fixed": "3.13.14"
          },
          {
            "introduced": "3.14.0"
          },
          {
            "fixed": "3.14.6"
          }
        ]
      }
    ],
    "package": {
      "name": "python",
      "purl": "pkg:bitnami/python",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V3",
        "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-7210.json"
    }
  }
]