CVE-2026-4224: Stack overflow parsing XML with deeply nested DTD content models
Modified
AliasesALPINE-CVE-2026-4224UBUNTU-CVE-2026-4224DEBIAN-CVE-2026-4224CGA-2cjc-h55h-4h7hCGA-2f3w-7jc7-vvjqCGA-5ch6-mfr3-xw68CGA-75wj-5wm7-mgqqCGA-g75c-f9wm-ccj8CGA-ghrg-q8g4-qmx3CGA-mv5w-r44x-pph4CGA-pvp9-hxgx-9m75CGA-rr8h-v3r3-xj5cCGA-v86f-hjgr-j355CGA-fw6p-3cf8-2m3cCGA-fw77-6gq7-q79j
Published 16-03-2026Last modified 13-08-2026
Vulnerability summary
CVE-2026-4224 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in python software foundation cpython. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.72%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 36 · Related 27MGASA-2026-0455OPENSUSE-SU-2026:10469-1OPENSUSE-SU-2026:10477-1OPENSUSE-SU-2026:10478-1OPENSUSE-SU-2026:10479-1OPENSUSE-SU-2026:10480-1OPENSUSE-SU-2026:10481-1OPENSUSE-SU-2026:20517-1RHSA-2026:10950RHSA-2026:19019RHSA-2026:19064RHSA-2026:19176RHSA-2026:19177RHSA-2026:7443RHSA-2026:7661RHSA-2026:8822RHSA-2026:8824SUSE-SU-2026:1206-1SUSE-SU-2026:1292-1SUSE-SU-2026:1296-1SUSE-SU-2026:1345-1SUSE-SU-2026:1349-1SUSE-SU-2026:1354-1SUSE-SU-2026:1376-1SUSE-SU-2026:1385-1SUSE-SU-2026:1417-1SUSE-SU-2026:1530-1SUSE-SU-2026:21104-1SUSE-SU-2026:21178-1SUSE-SU-2026:21254-1SUSE-SU-2026:23743-1SUSE-SU-2026:4534-1SUSE-SU-2026:4743-1SUSE-SU-2026:4754-1USN-8509-1USN-8744-1CGA-PC6G-F7G9-QMGW
Timeline
- 16-03-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.69% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu13 products
- pypy3All versions (No fix recorded)
- python2.7< 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-13ubuntu1.5+esm9
- python3.10< 3.10.12-1~22.04.16
- python3.11< 3.11.0~rc1-1~22.04.1+esm2
- python3.12< 3.12.3-1ubuntu0.15
Chainguard6 products
- python-3.10< 3.10.21-r6
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.14-r8
- python-3.13< 3.13.12-r7
- python-3.14< 3.14.3-r6
Wolfi5 products
- python-3.10< 3.10.21-r6
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.14-r8
- python-3.13< 3.13.12-r7
- python-3.14< 3.14.3-r6
Debian3 products
- python3.11< 3.11.2-6+deb12u8
- python3.13< 3.13.14-1 | < 3.13.5-2+deb13u2
- python3.14< 3.14.3-4
Alpine1 product
- python3< 3.12.14-r0 | < 3.14.5-r0
Python1 product
- python< 3.10.0 | ≥ 3.13.0, < 3.13.13 | ≥ 3.14.0, < 3.14.4 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.13 | ≥ 3.14.0, < 3.14.4 | ≥ 3.15.0a1, < 3.15.0a8
7 vendors · 30 products
References
19 links- mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/Vendor AdvisoryREPORTAdvisoryThird Party Advisory
Show all 19 references
- github.com/python/cpythonPACKAGE