CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681: Improper Restriction of Recursive Entity References in DTDs

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CLSA-2026-1780703662 python3: Fix of CVE-2026-7210

CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection xml.parsers.expat, xml.etree.ElementTree...

CLSA-2026-1780700848 python3: Fix of CVE-2026-7210

CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection xml.parsers.expat, xml.etree.ElementTree...

CLSA-2026-1780700238 python3: Fix of CVE-2026-7210

CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection xml.parsers.expat, xml.etree.ElementTree...

CLSA-2026-1780736179 python3.9: Fix of CVE-2026-7210

CVE-2026-7210: seed Expat with 16 bytes of hash salt via XMLSetHashSalt16Bytes when the linked libexpat exposes it, fixing the hash-flooding entropy gap in pyexpat and xml.etree.ElementTree - require expat = 2.5.0-1.el92.tuxcare.els12 CVE-2026-41080, XMLSetHashSalt16Bytes so the runtime...

ALPINE-CVE-2026-7210

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

AZL-109719 CVE-2026-7210 affecting package python-py 1.11.0-1

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

CVE-2026-7210

"xml.parsers.expat" and "xml.etree.ElementTree" use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

CVE-2026-7210

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

CVE-2026-7210: Insufficient Entropy

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

WS-2022-0266

The "xml.etree.ElementTree" module that mofh used up until version "1.0.1" implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to: - "Billion Laughs attack" https://en.wikipedia.org/wiki/Billionlaughsattack: It is a type of...