CVE-2026-7210

Aliases:ALPINE-CVE-2026-7210UBUNTU-CVE-2026-7210DEBIAN-CVE-2026-7210CGA-4h64-mv2w-5hppCGA-4jp4-99xm-3q68CGA-4wm6-gw95-xqv3CGA-6g24-ph8m-vj9mCGA-f2xq-5g85-fcv8CGA-fgg5-525j-xp8pCGA-gfww-cv55-vrm9CGA-mp75-hrgp-9999CGA-rgc2-288h-x4jpCGA-w82v-p6qf-2wr9
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 11 May 2026, 17:19
Last modified:14 Aug 2026, 00:28

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.67% LOW
1% probability -0.12%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 May 2026, 17:19
Published
Vulnerability first disclosed
14 Aug 2026, 00:28
Last Modified
Vulnerability information updated

Description

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.67%• Percentile: 51%

Techniques & Countermeasures

  • CWE-331•Insufficient Entropy

    The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Systems

  • alpine•python3

    < 3.12.14-r0 | < 3.12.14-r0 | < 3.12.14-r0 | < 3.14.7-r0

  • chainguard•python-3.10

    all

  • chainguard•python-3.11

    all | < 3.11.16-r7

  • chainguard•python-3.12

    all | < 3.12.14-r8

  • chainguard•python-3.13

    < 3.13.14-r0

  • chainguard•python-3.14

    < 3.14.6-r1

  • wolfi•python-3.10

    all

  • wolfi•python-3.11

    all | < 3.11.16-r7

  • wolfi•python-3.12

    all | < 3.12.14-r8

  • wolfi•python-3.13

    < 3.13.14-r0

  • wolfi•python-3.14

    < 3.14.6-r1

  • debian•python2.7

    all

  • debian•python3.11

    all

  • debian•python3.13

    all | < 3.13.14-1

  • debian•python3.14

    < 3.14.6-1

  • debian•python3.9

    all

  • ubuntu•python2.7

    all

  • ubuntu•python3.10

    all

  • ubuntu•python3.11

    all | all

  • ubuntu•python3.12

    all

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all | all

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • libexpat_project•libexpat

    < 2.8.0

  • python software foundation•cpython

    < 3.15.0 | < 3.13.14 | < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.14 | ≥ 3.14.0, < 3.14.6 | ≥ 3.15.0a1, < 3.15.0b2

  • python•python

    < 3.15.0 | < 3.13.14 | ≥ 3.14.0, < 3.14.6 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7 | 3.15.0:alpha8 | 3.15.0:beta1

References (19)