CVE-2026-4224
C Stack Overflow in Expat Parser via Nested DTD Content Model
Publication date: 2026-03-16
Last updated on: 2026-04-08
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | cpython | From 3.10 (inc) to 3.14 (inc) |
| python | cpython | From 3.10 (inc) to 3.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to update Python to a version that includes the fix for CVE-2026-4224.
The fix involves adding recursion depth checks in the conv_content_model function of the pyexpat module to prevent unbounded C recursion and stack overflow.
If updating is not immediately possible, avoid parsing XML documents with deeply nested inline DTD content models using the Expat parser with a registered ElementDeclHandler.
Monitor Python security advisories and apply patches or backports as soon as they become available for your Python version.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-4224 is a stack overflow vulnerability in Python's Expat XML parser, specifically in the `conv_content_model` function within the `pyexpat.c` source file."}, {'type': 'paragraph', 'content': 'The vulnerability occurs when an Expat parser with a registered ElementDeclHandler parses an inline Document Type Definition (DTD) containing a deeply nested content model. The function `conv_content_model` recursively converts XML content models without limiting recursion depth, which leads to unbounded C recursion.'}, {'type': 'paragraph', 'content': 'This unbounded recursion causes a C stack overflow, potentially crashing the Python interpreter.'}, {'type': 'paragraph', 'content': "The fix introduces recursion depth checks using Python's internal APIs `_Py_EnterRecursiveCall()` and `_Py_LeaveRecursiveCall()` to prevent excessive recursion and stack overflow by returning early if the recursion limit is exceeded."}] [1, 4, 5, 6]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can cause the Python interpreter to crash due to a C stack overflow when processing specially crafted XML documents with deeply nested content models.'}, {'type': 'paragraph', 'content': "If your application uses Python's `pyexpat` XML parser with an ElementDeclHandler and processes untrusted or malicious XML data, an attacker could exploit this vulnerability to cause denial of service by crashing the interpreter."}, {'type': 'paragraph', 'content': 'Such crashes could lead to service interruptions, potential data loss, or instability in applications relying on XML parsing.'}] [2, 3, 6]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability manifests as a stack overflow crash in the Python interpreter when parsing XML documents with deeply nested inline DTD content models using the Expat parser with a registered ElementDeclHandler.'}, {'type': 'paragraph', 'content': 'To detect if your system is vulnerable, you can attempt to parse a crafted XML document containing a deeply nested content model that triggers the recursion in the conv_content_model function.'}, {'type': 'paragraph', 'content': 'A test similar to the one added in the fix involves parsing an XML document with hundreds of thousands of nested elements in the DTD. If the parser crashes or the interpreter crashes with a stack overflow, the vulnerability is present.'}, {'type': 'paragraph', 'content': "While no specific detection commands are provided, you can create a test XML file with a deeply nested inline DTD and parse it using Python's xml.parsers.expat module with an ElementDeclHandler registered. Monitoring for crashes or RecursionError exceptions can indicate vulnerability."}] [1, 4, 5, 6]