vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-4224

Stack overflow parsing XML with deeply nested DTD content models

HIGH
7.5
CVSS Score
Published: March 16, 2026 at 05:52 PM UTC
Updated: August 13, 2026 at 01:16 AM UTC
1 product affected across 1 vendorPython

Using CPython by Python Software Foundation?

Get instant alerts when new vulnerabilities affect CPython - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Python· Python
95%
v < 3.10.0v < 3.10.213.11.0 ≤ v < 3.11.163.12.0 ≤ v < 3.12.143.13.0 ≤ v < 3.13.133.14.0 ≤ v < 3.14.43.15.0a1 ≤ v < 3.15.0a83.11.03.12.03.13.03.14.03.15.0 alpha13.15.0 alpha23.15.0 alpha33.15.0 alpha43.15.0 alpha53.15.0 alpha63.15.0 alpha73.15.0a1
Affected range stops below 3.10.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.10.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.12.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.13.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.14.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.15.0a8, so it looks safe — our inference, not a vendor statement

References (10)

Patch
Source: cverecord
https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768
Vendor AdvisoryThird Party Advisory
Source: cverecord
https://mail.python.org/archives/list/[email protected]/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/
Issue Tracking
Source: cverecord
https://github.com/python/cpython/issues/145986
Patch
Source: cverecord
https://github.com/python/cpython/pull/145987
Patch
Source: cverecord
https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a
Patch
Source: cverecord
https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3
Patch
Source: cverecord
https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785
Patch
Source: cverecord
https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-674

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card