Cyber Resilience

CVE-2026-7210

Python ≤ 3.13.14

Published
11 May 2026
Modified
27 July 2026
Patch / advisory
View advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0079 53th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-7210 is a medium-severity Insufficient Entropy (CWE-331) vulnerability in Python Python. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

CWE(s)
CWE-331

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
attack.mitre.org →
Why these techniques?

CWE-331 insufficient entropy enables crafted XML to trigger hash-flooding DoS against Python's expat/ElementTree parsers, directly mapping to application exhaustion via algorithmic complexity attack.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1499.003 Application Exhaustion Flood Impactconfidence: HIGH
Crafted XML triggers hash flooding in the parser, exhausting application resources.
attack.mitre.org →
T1499.004 Application or System Exploitation Impactconfidence: MEDIUM
Exploits insufficient entropy in XML hash protection to cause targeted DoS.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-7592Same product: Python Python
CVE-2024-6232Same product: Python Python
CVE-2023-33595Same product: Python Python
CVE-2026-3644Same product: Python Python
CVE-2026-6019Same product: Python Python
CVE-2026-4360Same product: Python Python
CVE-2023-40217Same product: Python Python
CVE-2025-13462Same product: Python Python
CVE-2024-9287Same product: Python Python
CVE-2025-13837Same product: Python Python

Affected Assets

python
python
3.15.0 · ≤ 3.13.14 · 3.14.0 — 3.14.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • SI-10 Information Input Validation
  • SC-13 Cryptographic Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.5.2
  • V11.3.4

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires patching xml.parsers.expat / ElementTree and updating libexpat to 2.8.0+ to eliminate the insufficient-entropy flaw.

SI-10 Information Input Validation partial match
prevent

Enforces validation or filtering of untrusted XML input before it reaches the vulnerable hash-seeded parser.

SC-13 Cryptographic Protection partial match
prevent

Mandates correct cryptographic-grade entropy for internal security mechanisms such as hash-flooding seeds.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly include vetted RNG and entropy sources, directly preventing this weakness while covering many other development concerns.

PR.AA-03 partial match
prevents

Password-strength policies implicitly require sufficient entropy, but the control addresses authentication rather than algorithmic randomness.

PR.DS-01 partial match
prevents

Proper encryption for data-at-rest requires sufficient entropy for keys/nonces; eliminating the weakness therefore supports but does not fully realize the control.

PR.DS-02 partial match
prevents

Cryptographic protection of data-in-transit depends on adequate entropy; the weakness directly undermines the control's effectiveness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography mostly match
prevents

Mandates use of cryptography that must rely on sufficient entropy sources.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect insufficient-entropy defects before release.

A.8.25 Secure development life cycle partial match
prevents

Secure-SDLC activities include entropy validation during design and testing.

A.8.28 Secure coding partial match
prevents

Secure-coding rules can explicitly forbid weak random-number generation.

A.8.5 Secure authentication partial match
degrades

Requires secure authentication mechanisms that depend on unpredictable secrets.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331
RHEL 8 (1 rule)
  • V-230223 RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331

References