CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

• CWE-335
• CWE-665
• CWE-909

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/105396Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041740Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:1260Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2030Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3725Third Party Advisory
• https://bugs.python.org/issue34623Issue Tracking, Patch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647Issue Tracking, Third Party Advisory
• https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
• https://usn.ubuntu.com/3817-1/Third Party Advisory
• https://usn.ubuntu.com/3817-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4306Third Party Advisory
• https://www.debian.org/security/2018/dsa-4307Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/105396Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041740Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:1260Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2030Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3725Third Party Advisory
• https://bugs.python.org/issue34623Issue Tracking, Patch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647Issue Tracking, Third Party Advisory
• https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
• https://usn.ubuntu.com/3817-1/Third Party Advisory
• https://usn.ubuntu.com/3817-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4306Third Party Advisory
• https://www.debian.org/security/2018/dsa-4307Third Party Advisory

Published

Sep 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14641A security flaw was found in the ip_frag_reasm() function in…6.5
• CVE-2018-14642An information leak vulnerability was found in Undertow. If …5.3
• CVE-2018-14643An authentication bypass flaw was found in the smart_proxy_d…9.8
• CVE-2018-14644An issue has been found in PowerDNS Recursor from 4.0.0 up t…5.3
• CVE-2018-14645A flaw was discovered in the HPACK decoder of HAProxy, befor…7.5
• CVE-2018-14646The Linux kernel before 4.15-rc8 was found to be vulnerable …5.5
• CVE-2018-14648A flaw was found in 389 Directory Server. A specially crafte…7.5
• CVE-2018-14649It was found that ceph-isci-cli package as shipped by Red Ha…9.8
• CVE-2018-1465IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtua…5.3
• CVE-2018-14650It was discovered that sos-collector does not properly set t…5.9
• CVE-2018-14651It was found that the fix for CVE-2018-10927, CVE-2018-10928…8.8
• CVE-2018-14652The Gluster file system through versions 3.12 and 4.1.4 is v…6.5