CVE-2026-7210

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end  of the sibling list, such as with [last()] or [last()-N];  .//item[1] short-circuits after the first match.(CVE-2026-6879)

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Root has patched CVE-2026-7210 in the python3 package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-7210 in the python3.9 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-7210 in the python3-defaults package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-7210 in the python3.13 package for Root:Debian:13. Multiple fixed versions available.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes (bound as a weak symbol; falls back to the legacy 8-byte XML_SetHashSalt when unavailable) to restore hash-flooding protection

• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection (CVE-2026-7210)
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the parser with 16 bytes of entropy when hash randomization is enabled; falls back to the legacy XML_SetHashSalt when unavailable.
  • CVE-2026-7210

• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection (CVE-2026-7210)
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the parser with 16 bytes of entropy; falls back to the legacy 8-byte XML_SetHashSalt when libexpat lacks the symbol.
  • CVE-2026-7210

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes (bound as a weak symbol; falls back to the legacy 8-byte XML_SetHashSalt when unavailable) to restore hash-flooding protection

• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection (CVE-2026-7210)
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the parser with 16 bytes of entropy when hash randomization is enabled; falls back to the legacy XML_SetHashSalt when unavailable.
  • CVE-2026-7210

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes (bound as a weak symbol; falls back to the legacy 8-byte XML_SetHashSalt when unavailable) to restore hash-flooding protection

• CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection (xml.parsers.expat, xml.etree.ElementTree)

• CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection (xml.parsers.expat, xml.etree.ElementTree)

• CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection (xml.parsers.expat, xml.etree.ElementTree)

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes (bound as a weak symbol; falls back to the legacy 8-byte XML_SetHashSalt when unavailable) to restore hash-flooding protection

• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection (CVE-2026-7210)
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the parser with 16 bytes of entropy; falls back to the legacy 8-byte XML_SetHashSalt when libexpat lacks the symbol.
  • CVE-2026-7210

• CVE-2026-7210: seed Expat with 16 bytes of hash salt via XML_SetHashSalt16Bytes when the linked libexpat exposes it, fixing the hash-flooding entropy gap in pyexpat and xml.etree.ElementTree
• require expat >= 2.5.0-1.el9_2.tuxcare.els12 (CVE-2026-41080, XML_SetHashSalt16Bytes) so the runtime mitigation is guaranteed in effect

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes (bound as a weak symbol; falls back to the legacy 8-byte XML_SetHashSalt when unavailable) to restore hash-flooding protection

• CVE-2026-7210: seed pyexpat/_elementtree with 16-byte XML hash salt via XML_SetHashSalt16Bytes; detect the symbol at runtime through a weak declaration so the fix engages against system libexpat 2.5.0 with the CVE-2026-41080 backport; add hard Requires on expat >= 2.5.0-1.el9_2.tuxcare.els12

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes when hash randomization is enabled (bound as a weak symbol; falls back to the legacy XML_SetHashSalt when unavailable) to restore hash-flooding protection

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes when hash randomization is enabled (bound as a weak symbol; falls back to the legacy XML_SetHashSalt when unavailable) to restore hash-flooding protection

• CVE-2026-7210: seed the libexpat parser with 16 bytes of entropy via XML_SetHashSalt16Bytes when hash randomization is enabled (bound as a weak symbol; falls back to the legacy XML_SetHashSalt when unavailable) to restore hash-flooding protection

• SECURITY UPDATE: tarfile misinterprets crafted multi-block GNU long name archives via AREGTYPE/DIRTYPE normalization
  • debian/patches/CVE-2025-13462.patch: skip the old-v7 AREGTYPE to DIRTYPE normalization when reading the follow-up header of a GNU LONGNAME / LONGLINK or PAX member in Lib/tarfile.py
  • CVE-2025-13462
• SECURITY UPDATE: C stack overflow in pyexpat when an ElementDeclHandler parses a deeply nested content model
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() recursion with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() in Modules/pyexpat.c
  • CVE-2026-4224
• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the Expat parser with 16 bytes of entropy when hash randomization is enabled; falls back to the legacy XML_SetHashSalt when unavailable. Requires libexpat1 (>= 2.2.6-2+deb10u7+tuxcare.els6).
  • CVE-2026-7210

• CVE-2026-7210: when hash randomization is enabled, seed libexpat's hash-flooding protection in pyexpat with a full 16 bytes of entropy via XML_SetHashSalt16Bytes, detected at runtime through a weak symbol so it activates once the system libexpat exposes it, instead of the 4-8 byte XML_SetHashSalt

• CVE-2026-7210: seed Expat's hash-flooding protection with a full 16 bytes (128 bits) of entropy via XML_SetHashSalt16Bytes() when the loaded libexpat provides it (detected via a weak symbol), instead of the brute-forceable 8-byte XML_SetHashSalt(); the pyexpat CAPI gains a SetHashSalt16Bytes pointer appended at the end of the struct (capsule magic unchanged) and _Py_HashSecret_t gains a 16-byte hashsalt16 field. Both call sites fall back to the legacy 8-byte API when the salt is all zeros (hash randomization off, the default) so Expat keeps self-seeding. Paired with the libexpat CVE-2026-41080 backport that exports the symbol; requires expat >= 2.1.0-15.0.7.el7_9.tuxcare.els3, the release shipping it

• CVE-2026-7210: seed Expat's hash-flooding protection with a full 16 bytes (128 bits) of entropy via XML_SetHashSalt16Bytes() when the loaded libexpat provides it (detected via a weak symbol), instead of the brute-forceable 8-byte XML_SetHashSalt(); the pyexpat CAPI gains a SetHashSalt16Bytes pointer appended at the end of the struct (capsule magic unchanged) and _Py_HashSecret_t gains a 16-byte hashsalt16 field. Both call sites fall back to the legacy 8-byte API when the salt is all zeros (hash randomization off, the default) so Expat keeps self-seeding. Paired with the libexpat CVE-2026-41080 backport that exports the symbol; requires expat >= 2.1.0-15.0.7.el7_9.tuxcare.els3, the release shipping it

• SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers
  • debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py).
  • CVE-2025-13462
• SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model
  • debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.support helpers and a 500000-deep model); the fix was verified manually.
  • CVE-2026-4224
• SECURITY UPDATE: control-character injection in http.cookies (HTTP response splitting)
  • debian/patches/CVE-2026-3644.patch: reject control characters (\x00-\x1F, \x7F) in Lib/http/cookies.py across all Morsel/BaseCookie paths via a new _has_control_character() helper. CVE-2026-3644 is the incomplete-fix follow-up to CVE-2026-0672 and its upstream fix (commit 57e88c1cf9, gh-145599) depends on the helper introduced by the CVE-2026-0672 base commit (95746b3a13, gh-143919). 3.7.3 shipped neither fix, so this patch bundles both: the base validation in Morsel.setitem/setdefault/set and BaseCookie.output, plus the follow-up validation in Morsel.update/setstate and BaseCookie.js_output. Also closes CVE-2026-0672. The upstream Morsel.ior override is omitted: it only exists to neutralize dict.ior (PEP 584, Python 3.9+), which 3.7 does not have, so there is no |= bypass to close. The module docstring doctest and the test_basic keebler fixture in test_http_cookies.py are updated to drop a \012 control character now rejected by load(), and the upstream regression tests test_control_characters/test_control_characters_output are bundled with the test.support.control_characters_c0() helper they require.
  • CVE-2026-3644

• CVE-2026-7210: when hash randomization is enabled, seed libexpat's hash-flooding protection in pyexpat with a full 16 bytes of entropy via XML_SetHashSalt16Bytes, detected at runtime through a weak symbol so it activates once the system libexpat exposes it, instead of the 4-8 byte XML_SetHashSalt

• CVE-2026-7210: seed Expat's hash-flooding protection with a full 16 bytes (128 bits) of entropy via XML_SetHashSalt16Bytes() when the loaded libexpat provides it (detected via a weak symbol), instead of the brute-forceable 8-byte XML_SetHashSalt(); the pyexpat CAPI gains a SetHashSalt16Bytes pointer appended at the end of the struct (capsule magic unchanged) and _Py_HashSecret_t gains a 16-byte hashsalt16 field. Both call sites fall back to the legacy 8-byte API when the salt is all zeros (hash randomization off, the default) so Expat keeps self-seeding. Paired with the libexpat CVE-2026-41080 backport that exports the symbol; requires expat >= 2.1.0-15.0.7.el7_9.tuxcare.els3, the release shipping it

• SECURITY UPDATE: Insufficient entropy in pyexpat/_elementtree hash-flooding protection
  • debian/patches/CVE-2026-7210.patch: apply CVE-2026-7210
  • CVE-2026-7210

These are all security issues fixed in the python315-3.15.0~b2-1.1 package on the GA media of openSUSE Tumbleweed.