gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) by StanFromIreland · Pull Request #145987 · python/cpython

StanFromIreland · 2026-03-15T19:38:35Z

Issue: pyexpat.c: Unbounded C recursion in conv_content_model causes crash (CVE 2026-4224) #145986

Lib/test/test_pyexpat.py

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Lib/test/test_pyexpat.py

miss-islington-app · 2026-03-15T21:46:10Z

Thanks @StanFromIreland for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

… `pyexpat.c` (CVE 2026-4224) (pythonGH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-15T21:46:32Z

GH-145995 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2026-03-15T21:46:33Z

Sorry, @StanFromIreland and @picnixz, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 3.12

bedevere-app · 2026-03-15T21:46:36Z

GH-145996 is a backport of this pull request to the 3.13 branch.

miss-islington-app · 2026-03-15T21:46:36Z

Sorry, @StanFromIreland and @picnixz, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 3.11

miss-islington-app · 2026-03-15T21:46:39Z

Sorry, @StanFromIreland and @picnixz, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 3.10

…del` in `pyexpat.c` (CVE 2026-4224) (pythonGH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-15T22:02:07Z

GH-145999 is a backport of this pull request to the 3.12 branch.

…del` in `pyexpat.c` (CVE 2026-4224) (pythonGH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) (cherry picked from commit e5caf45) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-15T22:02:54Z

GH-146000 is a backport of this pull request to the 3.11 branch.

…del` in `pyexpat.c` (CVE 2026-4224) (pythonGH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) (cherry picked from commit e5caf45) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-15T22:10:18Z

GH-146002 is a backport of this pull request to the 3.10 branch.

…n `pyexpat.c` (CVE 2026-4224) (GH-145987) (#145995) gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…n `pyexpat.c` (CVE 2026-4224) (GH-145987) (#145996) * gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered `ElementDeclHandler` parses inline DTD containing deeply nested content model. --------- (cherry picked from commit eb0e8be) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> * Remvoe `skip_if_unlimited_stack_size` decorator * Remove more decorators not on this branch --------- Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

StanFromIreland added 5 commits March 14, 2026 17:35

Fix crash in conv_content_model function in pyexpat

d3dd837

Update test

adb61a2

Simplify test

c3837af

Simplify test a lil' more

2d3bdd0

Add issue number

1481875

StanFromIreland requested a review from picnixz March 15, 2026 19:38

StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 15, 2026

bedevere-app bot mentioned this pull request Mar 15, 2026

pyexpat.c: Unbounded C recursion in conv_content_model causes crash (CVE 2026-4224) #145986

Open

bedevere-app bot added the awaiting review label Mar 15, 2026

picnixz reviewed Mar 15, 2026

View reviewed changes

Lib/test/test_pyexpat.py Show resolved Hide resolved

picnixz reviewed Mar 15, 2026

View reviewed changes

Lib/test/test_pyexpat.py Outdated Show resolved Hide resolved

Bénédikt's review

e62a670

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

StanFromIreland requested a review from picnixz March 15, 2026 19:43

picnixz reviewed Mar 15, 2026

View reviewed changes

Lib/test/test_pyexpat.py Show resolved Hide resolved

Update Lib/test/test_pyexpat.py

16d5b10

picnixz approved these changes Mar 15, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Mar 15, 2026

picnixz changed the title ~~gh-145986: Avoid unbound C recursion in conv_content_model in pyexpat.c~~ gh-145986: Avoid unbound C recursion in conv_content_model in pyexpat.c (CVE 2026-4224) Mar 15, 2026

picnixz merged commit eb0e8be into python:main Mar 15, 2026
55 checks passed

bedevere-app bot removed the awaiting merge label Mar 15, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Mar 15, 2026

miss-islington-app bot assigned picnixz Mar 15, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Mar 15, 2026

StanFromIreland deleted the expat-crash branch March 15, 2026 21:48

StanFromIreland assigned StanFromIreland and unassigned picnixz Mar 15, 2026

bedevere-app bot removed the needs backport to 3.12 only security fixes label Mar 15, 2026

bedevere-app bot removed the needs backport to 3.11 only security fixes label Mar 15, 2026

bedevere-app bot removed the needs backport to 3.10 only security fixes label Mar 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224)#145987

gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224)#145987
picnixz merged 7 commits intopython:mainfrom
StanFromIreland:expat-crash

StanFromIreland commented Mar 15, 2026 •

edited by bedevere-app bot

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

StanFromIreland commented Mar 15, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

miss-islington-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

bedevere-app bot commented Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

StanFromIreland commented Mar 15, 2026 •

edited by bedevere-app bot

Loading