René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[CVE-2026-7210] Insufficient entropy in `pyexpat` with protection against hash flooding","articleBody":"Hi!\n\npyexpat calls `XML_SetHashSalt` which only passes 4 to 8 bytes of entropy to protect against hash flooding. Expat 2.8.0 introduced a new API function [`XML_SetHashSalt16Bytes`](https://libexpat.github.io/doc/api/latest/#XML_SetHashSalt16Bytes) that allows CPython to pass sufficient entropy (16 bytes). Please make pyexpat call `XML_SetHashSalt16Bytes` when compiled against recent enough Expat to fix what is known as CVE-2026-41080 to Expat itself for CPython. The [change log of Expat 2.8.0](https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes) has more details.\n\nThanks and best, Sebastian\n\nCVE-2026-7210\n\nCC #149017\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-149023\n* gh-149645\n* gh-149646\n* gh-151160\n* gh-152188\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/hartwork","@type":"Person","name":"hartwork"},"datePublished":"2026-04-26T16:35:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":9},"url":"https://github.com/149018/cpython/issues/149018"}