CVE-2026-7210: Libexpat XXE Vulnerability

CVE-2026-7210 Overview

CVE-2026-7210 affects Python's xml.parsers.expat and xml.etree.ElementTree modules, which rely on the libexpat library for XML parsing. The vulnerability stems from insufficient entropy in the hash-flooding protection mechanism used by Expat. Attackers can craft malicious XML documents that trigger hash collisions, leading to algorithmic complexity attacks that degrade parser performance. This weakness is categorized under [CWE-331] Insufficient Entropy. Full mitigation requires upgrading libexpat to version 2.8.0 or later in combination with the Python patch.

Critical Impact

Crafted XML documents can trigger hash flooding in Python's XML parsing stack, causing CPU exhaustion and denial of service in applications that process untrusted XML input.

Affected Products

• libexpat (all versions prior to 2.8.0)
• Python xml.parsers.expat module
• Python xml.etree.ElementTree module

Discovery Timeline

• 2026-05-11 - CVE-2026-7210 published to NVD
• 2026-05-16 - Last updated in NVD database

Technical Details for CVE-2026-7210

Vulnerability Analysis

The vulnerability is an algorithmic complexity attack against the hash table used internally by libexpat to manage XML entities and element names. Expat implements hash-flooding protection by randomizing its hash function with a per-process seed. The protection breaks down when the seed lacks sufficient entropy, allowing attackers to predict hash outputs and craft inputs that collide into the same hash bucket.

When hash buckets become heavily populated with collisions, lookups degrade from amortized constant time to linear time per operation. Processing a maliciously crafted XML document then forces the parser into quadratic complexity, consuming disproportionate CPU resources. Applications such as web services, configuration parsers, and document processors that accept XML from untrusted sources are exposed to denial-of-service conditions.

Root Cause

The root cause is weak seed generation for the Expat hash function. The entropy source used to randomize the hash did not produce values resistant to reverse-engineering, so an attacker who understood the seed distribution could pre-compute strings that map to identical hash buckets. The Python xml.parsers.expat and xml.etree.ElementTree modules inherit this weakness directly from the underlying libexpat library.

Attack Vector

Exploitation requires the target application to parse attacker-controlled XML. The attacker submits a document containing many element or entity names crafted to collide in Expat's internal hash table. No authentication or user interaction is required when the XML endpoint is network-exposed. The attack only impacts availability — confidentiality and integrity are not affected.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the GitHub Issue Report for technical discussion.

Detection Methods for CVE-2026-7210

Indicators of Compromise

• Sustained high CPU utilization in processes parsing XML, especially Python workers using xml.etree.ElementTree or xml.parsers.expat.
• Inbound XML payloads containing unusually large numbers of distinct element names, attributes, or entity references.
• Web request latency spikes correlated with specific XML POST bodies or uploads.

Detection Strategies

• Inspect XML traffic at the application gateway for documents that exceed size or element-count thresholds appropriate for the workload.
• Monitor Python process runtime metrics and stack traces during XML parsing to identify abnormal time spent in Expat internals.
• Correlate request source IPs with elevated parser CPU usage to identify deliberate flooding attempts.

Monitoring Recommendations

• Enable resource limits (RLIMIT_CPU, container CPU quotas) on services that parse XML from untrusted sources.
• Log XML parsing duration per request and alert on outliers exceeding baseline percentiles.
• Track libexpat and Python interpreter versions across the fleet to confirm patched releases are deployed.

How to Mitigate CVE-2026-7210

Immediate Actions Required

• Upgrade libexpat to version 2.8.0 or later on all systems that link against it, including container base images.
• Apply the Python patch from the CPython Pull Request; both fixes are required for complete mitigation.
• Inventory applications using xml.etree.ElementTree, xml.parsers.expat, or third-party libraries that wrap Expat.
• Restrict XML parsing endpoints to authenticated clients where business requirements allow.

Patch Information

The fix is delivered through two coordinated changes. First, libexpat 2.8.0 strengthens its internal hash randomization. Second, the CPython patch tracked in the Python Security Announcement ensures Python supplies adequate entropy to Expat at initialization. Applying only one of the two patches leaves the protection partially bypassable.

Workarounds

• Enforce strict input size limits on XML payloads at the reverse proxy or application layer before parsing begins.
• Reject XML documents that contain more elements, attributes, or entities than the application legitimately requires.
• Isolate XML parsing into a sandboxed worker process with CPU and memory caps so denial of service cannot cascade.
• Where feasible, prefer alternative serialization formats such as JSON for untrusted input until patched packages are deployed.

# Verify installed libexpat and Python versions
dpkg -l | grep -i expat
python3 -c "import xml.parsers.expat; print(xml.parsers.expat.EXPAT_VERSION)"

# Upgrade on Debian/Ubuntu after distribution package availability
sudo apt update && sudo apt install --only-upgrade libexpat1 python3