← Back

CVE-2026-4224

nvd nist
Published: Mar 16, 2026Modified: Aug 13, 2026

JSON object

Loading...
6.0
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: CNA (Secondary)

Description

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

Affected (10)

Products: Python: Python
Python
1 product
Python
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Python
Python
version < 3.10.0
Python
3.13.0 ≤ version < 3.13.13
Python
3.14.0 ≤ version < 3.14.4
Python
Version 3.15.0 alpha1
Python
Version 3.15.0 alpha2
Python
Version 3.15.0 alpha3
Python
Version 3.15.0 alpha4
Python
Version 3.15.0 alpha5
Python
Version 3.15.0 alpha6
Python
Version 3.15.0 alpha7

Related CWEs

CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (10)

Source: cna@python.org
Patch
Source: cna@python.org
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Issue Tracking
Source: cna@python.org
Patch
Source: cna@python.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.