Hi!

pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.

Thanks and best, Sebastian

CVE-2026-7210

CC #149017

Linked PRs

• gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible #149023
• [3.15] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149645
• [3.14] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149646
• [3.13] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #151160