[CVE-2026-7210] Insufficient entropy in `pyexpat` with protection against hash flooding

[hartwork]

Hi!

pyexpat calls XML_SetHashSalt which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function XML_SetHashSalt16Bytes that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call XML_SetHashSalt16Bytes when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The change log of Expat 2.8.0 has more details.

Thanks and best, Sebastian

CVE-2026-7210

CC #149017

Linked PRs

• gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible #149023
• [3.15] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149645
• [3.14] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149646
• [3.13] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #151160
• [3.10] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #152188
• [3.12] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #155345

[serhiy-storchaka]

Why call XML_SetHashSalt if Expact by default uses high quality entropy if XML_SetHashSalt was not called? If we able to get high quality entropy for Expact, Expact is able to get it itself.

The call of XML_SetHashSalt was added in 8e91cf6 (bpo-14234/gh-58442). cc @gpshead

[StanFromIreland]

Expact is able to get it itself.

We don't vendor the necessary files, see this thread: #149020 (comment)