CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models
A stack overflow in the Expat parser within CPython can cause a denial of service when processing deeply nested XML DTD content models with a registered handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4224?
CVE-2026-4224 is a medium-severity denial of service vulnerability in Python Python, published on 16 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
Weakness: CWE-674
Which versions are affected by CVE-2026-4224?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4 |
Products include Python Python.
How do I fix CVE-2026-4224?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.13.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-4224 being exploited?
There is no known exploitation of CVE-2026-4224 in the wild and no public exploit code.
Other vulnerabilities in Python Python
Sources
Also known as ALPINE-CVE-2026-4224, AZL-109707, AZL-80046, BELL-CVE-2026-4224, BIT-libpython-2026-4224, BIT-python-2026-4224 and 15 more.