Search/CVE-2026-7210
● CVE — High

CVE-2026-7210

VendorpythonProductpythonDiscoveredMay 11, 2026UpdatedOct 26, 2026

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
0.67%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 14, 2026 → Oct 22, 2026
▼ 0.14pp
0.81% → 0.67% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
May 11, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026