« List of all CVEs

CVE-2026-4224

Stack overflow parsing XML with deeply nested DTD content models

Published: 3/16/2026 Last updated: 4/8/2026 Reserved: 3/15/2026

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

CNA assigner: PSF (28c92f92-d60d-412d-b760-e73465c3df22) Requested by: n/a

Metrics

Version Score Severity Vector String
4.0 6 Medium CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Opam packages affected (7)

conf-python-2-7 conf-python-2-7-dev conf-python-3 conf-python-3-7 conf-python-3-dev py termbox

Products affected (2)

Product Vendor Version
CPython Python Software Foundation n/a
CPython Python Software Foundation n/a

References (16)

Credits (8)