CVE-2026-4224

A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash.

This Moderate severity flaw in CPython's Expat parser can lead to a denial of service. The vulnerability occurs when an application using the Expat parser with a registered ElementDeclHandler processes an XML document containing a deeply nested Document Type Definition (DTD) content model. Exploitation requires specific conditions, making the attack complexity high.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.