CVE-2026-4224

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

• CWE-674

• https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4aPatch
• https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621
• https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785Patch
• https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914feePatch
• https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3Patch
• https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768Patch
• https://github.com/python/cpython/issues/145986Issue Tracking
• https://github.com/python/cpython/pull/145987Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/03/16/4Mailing List, Third Party Advisory

Published

Mar 16, 2026

Last Modified

Aug 5, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42234n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-42235n8n is an open source workflow automation platform. Prior to…9.6
• CVE-2026-42236n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-42237n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-42238Nginx UI is a web user interface for the Nginx web server. P…9.8
• CVE-2026-42239Budibase is an open-source low-code platform. Prior to versi…8.1
• CVE-2026-42241ParquetSharp is a .NET library for reading and writing Apach…5.3
• CVE-2026-42245Net::IMAP implements Internet Message Access Protocol (IMAP)…7.5
• CVE-2026-42246Net::IMAP implements Internet Message Access Protocol (IMAP)…7.4
• CVE-2026-42248Ollama for Windows does not perform integrity or authenticit…9.8
• CVE-2026-42249Ollama for Windows contains a Remote Code Execution vulnerab…9.8
• CVE-2026-4225A security flaw has been discovered in CMS Made Simple up to…2.4