mirror of
https://git.yoctoproject.org/poky
synced 2026-10-24 07:48:24 +00:00
Amaury Couderc
44913c2842
CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree). An attacker can craft XML input that forces O(n²) hash collisions in libexpat's internal name dictionary, causing excessive CPU consumption. The previous mitigation seeded libexpat's hash function with only 4 bytes of entropy, which is insufficient against a determined attacker. This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0), providing a full 16-byte secret. Older expat versions fall back gracefully to the legacy XML_SetHashSalt via a runtime NULL check. Backport patch to fix CVE-2026-7210. https://nvd.nist.gov/vuln/detail/CVE-2026-7210 Upstream fix: https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 -- Changes from Upstream -- Replace compile-time version checks with runtime detection of the XML_SetHashSalt16Bytes function using #pragma weak. This allows using backported security fixes from expat even when version macros haven't been bumped (in thus case expat 2.6.4 with CVE-2026-41080). - Add weak symbol declaration for XML_SetHashSalt16Bytes - Convert newxmlparseobject() version check to runtime NULL check - Convert pyexpat_exec() CAPI export check to runtime NULL check Tested with ptest: Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882 After: PASSED: 40020, FAILED: 0, SKIPPED: 1882 CVE: CVE-2026-7210 (From OE-Core rev: d753c46085c9d31f3b68d59f863855c909a6f400) Signed-off-by: Amaury Couderc <amaury.couderc@est.tech> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>