Security readout for executives and security teams
Plain-English summary
A specially structured XML document can crash a vulnerable CPython process when its Expat parser uses an ElementDeclHandler. The result is service disruption, not disclosed data theft or modification. Exploitation requires deeply nested content within an inline DTD and the affected handler configuration.
Executive priority
Treat as a targeted availability issue rather than an enterprise-wide emergency. Patch internet-facing or multi-tenant XML-processing services promptly when the vulnerable handler path is present. Lower priority is reasonable where the handler is absent or untrusted inline DTDs cannot reach the parser, after validation.
Technical view
Deep recursion while Expat parses a nested DTD content model can exhaust the C call stack, causing a stack overflow. The CVSS 4.0 assessment is 6.0 and availability-only, with low attack complexity, low privileges, no user interaction, and an additional prerequisite condition. The weakness is CWE-674: uncontrolled recursion.
Likely exposure
Exposure is most likely where listed CPython versions parse attacker-influenced XML containing inline DTDs and register ElementDeclHandler. Applications that reject untrusted XML or do not configure that handler are less likely to reach the vulnerable path. The bundle lists versions ambiguously, so confirm applicability through the Python advisory.
Exploitation context
The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation. A network attack is reflected in the CVSS vector, but it requires low privileges and a prerequisite condition. Expected impact is process termination or denial of service.
Researcher notes
The critical reachability condition is a registered ElementDeclHandler parsing an inline DTD with a deeply nested content model. The supplied record indicates no confidentiality or integrity impact. Multiple CPython patch commits are referenced, but the bundle does not clearly state exact fixed release numbers or a complete affected-version range.
Mitigation direction
- Review the Python security advisory and apply the vendor-fixed release appropriate to each maintained CPython branch.
- Prioritize services parsing attacker-controlled XML with inline DTD support and ElementDeclHandler enabled.
- Until patched, restrict untrusted XML ingestion or reject inline DTD content where operationally feasible.
- Restart or redeploy updated services and confirm runtime versions changed.
Validation and detection
- Inventory CPython versions across services that process XML.
- Identify applications registering ElementDeclHandler and document whether XML input crosses an untrusted boundary.
- Confirm deployed builds include the applicable CPython patch or vendor-fixed release.
- Run vendor regression tests in a non-production environment without using public exploit payloads.
- Monitor XML-processing services for abnormal crashes, restarts, or availability degradation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-674: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-4224 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
6MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768CVE reference, PSF · patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/issues/145986CVE reference, PSF · issue-tracking
- https://github.com/python/cpython/pull/145987CVE reference, PSF · patch
- https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4aCVE reference, PSF · patch
- https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3CVE reference, PSF · patch
- https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785CVE reference, PSF · patch
- https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914feeCVE reference, PSF · patch
- https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Recursion
Uncontrolled Recursion represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.