Hello, On Mon Jul 6, 2026 at 3:26 PM CEST, Amaury Couderc via lists.openembedded.org wrote: > From: Amaury Couderc <[email protected]> > > CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in > Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree). > An attacker can craft XML input that forces O(n²) hash collisions in > libexpat's internal name dictionary, causing excessive CPU consumption. > > The previous mitigation seeded libexpat's hash function with only 4 > bytes of entropy, which is insufficient against a determined attacker. > This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0), > providing a full 16-byte secret. Older expat versions fall back > gracefully to the legacy XML_SetHashSalt via a runtime NULL check. > > Backport patch to fix CVE-2026-7210. > https://nvd.nist.gov/vuln/detail/CVE-2026-7210 > > Upstream fix: > > https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 > > Tested with ptest: > Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882 > After: PASSED: 40020, FAILED: 0, SKIPPED: 1882 > > CVE: CVE-2026-7210 > > Signed-off-by: Amaury Couderc <[email protected]> > --- > > NOTE: CVE-2026-7210 full mitigation requires the companion > expat CVE-2026-41080 patch (raises expat to >= 2.8.0 API) > > .../python/python3/CVE-2026-7210.patch | 122 ++++++++++++++++++ > .../python/python3_3.12.13.bb | 1 + > 2 files changed, 123 insertions(+) > create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-7210.patch > > diff --git a/meta/recipes-devtools/python/python3/CVE-2026-7210.patch > b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch > new file mode 100644 > index 0000000000..8acf174a0a > --- /dev/null > +++ b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch > @@ -0,0 +1,122 @@ > +From 2ed6138dea0bc94c726f879501e4525712e885d1 Mon Sep 17 00:00:00 2001 > +From: Stan Ulbrych <[email protected]> > +Date: Sun, 10 May 2026 18:36:26 +0100 > +Subject: [PATCH] gh-149018: Use `XML_SetHashSalt16Bytes` in > + `pyexpat`/`_elementtree` when possible (#149023) > + > + > +CVE: CVE-2026-7210 > +Upstream-Status: Backport > [https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4] > + > +Signed-off-by: Amaury Couderc <[email protected]> > +--- > + Include/pyexpat.h | 3 +++ > + Include/pyhash.h | 8 +++++--- > + .../2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst | 3 +++ > + Modules/_elementtree.c | 8 ++++++-- > + Modules/pyexpat.c | 10 +++++++++- > + 5 files changed, 26 insertions(+), 6 deletions(-) > + create mode 100644 > Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
The patched files have slighty changed Include/internal/pycore_pyhash.h -> Include/pyhash.h This time, I could check that nothing important changed but next time I'd like a like a little change log about what changed between upstream and the imported patch. > [...] > +diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c > +index 79492ca5c4f..388473d3855 100644 > +--- a/Modules/pyexpat.c > ++++ b/Modules/pyexpat.c > +@@ -1388,7 +1388,10 @@ newxmlparseobject(pyexpat_state *state, const char > *encoding, > + Py_DECREF(self); > + return NULL; > + } > +-#if XML_COMBINED_VERSION >= 20100 > ++#if XML_COMBINED_VERSION >= 20800 > ++ /* This feature was added upstream in libexpat 2.8.0. */ > ++ XML_SetHashSalt16Bytes(self->itself, _Py_HashSecret.expat.hashsalt16); > ++#elif XML_COMBINED_VERSION >= 20100 > + /* This feature was added upstream in libexpat 2.1.0. */ > + XML_SetHashSalt(self->itself, > + (unsigned long)_Py_HashSecret.expat.hashsalt); > +@@ -2257,6 +2260,11 @@ pyexpat_exec(PyObject *mod) > + #else > + capi->SetHashSalt = NULL; > + #endif > ++#if XML_COMBINED_VERSION >= 20800 > ++ capi->SetHashSalt16Bytes = XML_SetHashSalt16Bytes; > ++#else > ++ capi->SetHashSalt16Bytes = NULL; > ++#endif > + #if XML_COMBINED_VERSION >= 20600 > + capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled; > + #else We did not upgrade expat but patched in the fixing API XML_SetHashSalt16Bytes. Can you check we can activate the fixed code path with those "#if XML_COMBINED_VERSION >= 20800"? I will hold the patch in the meantime, I really want to avoid a false negative in CVE data. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241304): https://lists.openembedded.org/g/openembedded-core/message/241304 Mute This Topic: https://lists.openembedded.org/mt/120139168/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
