Hi!

pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.

Thanks and best, Sebastian

CVE-2026-7210

CC #149017

Linked PRs

• gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible #149023
• [3.15] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149645
• [3.14] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149646
• [3.13] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #151160
• [3.10] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #152188
• [3.12] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #155345
• [3.11] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) (GH-155345) #155610
• [3.10] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #155611