CVE-2026-4224Disclosure(python / python)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch python python systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

python CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-674

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

python

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 4d ago at 2 mentions (2026-03-16); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

python

Products

python

1 version affected across 1 product

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Disclosure

571.4%

Patch

228.6%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-16	2	Disclosure2
2026-03-17	2	Disclosure2
2026-04-02	1	Disclosure1
2026-04-17	1	Patch1
2026-04-18	1	Patch1

Full discourse7 posts

Open Source Security mailing list@oss_security206d
Disclosure
CVE-2026-4224: CPython: Stack overflow parsing XML with deeply nested DTD content models https://www.openwall.com/lists/oss-security/2026/03/16/4 CVE-2026-3644: CPython: Incomplete control character validation in http.cookies https://www.openwall.com/lists/oss-security/2026/03/16/5
Post summary
Two new CPython vulnerabilities have been disclosed: CVE-2026-4224 causes a stack overflow when parsing XML with deeply nested DTD content models, while CVE-2026-3644 involves incomplete control character validation in http.cookies; no exploits, patches, or PoCs are referenced.
02095842
4.4K followersView on X
Lambda Watchdog@LambdaWatchdog174d
Patch
🔍 Lambda Watchdog detected that CVE-2026-4224 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/456 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
Lambda Watchdog reported that CVE‑2026‑4224 is no longer detected in the latest AWS Lambda base image scans, suggesting the vulnerability has been removed or patched in that environment.
0000037
31 followersView on X
Lambda Watchdog@LambdaWatchdog175d
Patch
🔍 Lambda Watchdog detected that CVE-2026-4224 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/456 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
The post reports that CVE‑2026‑4224 has been resolved in the latest AWS Lambda base image scans, indicating a patch or remediation has been applied.
0000020
34 followersView on X
Lambda Watchdog@LambdaWatchdog190d
Disclosure
🚨 New MEDIUM CVE detected in AWS Lambda 🚨 CVE-2026-4224 impacts python in 7 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/456 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
Post summary
A new medium‑severity vulnerability, CVE‑2026‑4224, affecting Python in seven AWS Lambda base images has been reported, with links to issue details but no PoC, exploit, or patch information disclosed.
0000038
32 followersView on X
CVE@CVEnew206d
Disclosure
CVE-2026-4224 When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. https://www.cve.org/CVERecord?id=CVE-2026-4224
Post summary
The message announces CVE‑2026‑4224, describing a stack overflow in Expat’s DTD handling; it provides technical details but no PoC, exploitation evidence, patches, or debunking claims.
00000104
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash207d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4224 - Stack overflow parsing XML with deeply nested DTD content models Intel Report: https://ift.tt/OaIPNSd
Post summary
A new CVE‑2026‑4224 about a stack overflow in XML parsing with nested DTD content models is announced, with a link to an Intel report.
0000046
335 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash207d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4224 - Stack overflow parsing XML with deeply nested DTD content models Intel Report: https://ift.tt/BkQjA1q
Post summary
The alert announces CVE‑2026‑4224, a stack overflow vulnerability triggered by deeply nested DTD XML, but provides no PoC, exploit tools, evidence of active use, or patch information.
0000039
335 followersView on X

CPE platform detail8 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

8 of 8 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	python	python	-	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-

Explore more

Back to dashboard python CVEs python vulnerabilities

What researchers are saying

CVE-2026-4224

Open Source Security mailing list@oss_securityDisclosure

Two new CPython vulnerabilities have been disclosed: CVE-2026-4224 causes a stack overflow when parsing XML with deeply nested DTD content models, while CVE-2026-3644 involves incomplete control character validation in http.cookies; no exploits, patches, or PoCs are referenced.

Lambda Watchdog@LambdaWatchdogPatch

Lambda Watchdog reported that CVE‑2026‑4224 is no longer detected in the latest AWS Lambda base image scans, suggesting the vulnerability has been removed or patched in that environment.

Lambda Watchdog@LambdaWatchdogPatch

The post reports that CVE‑2026‑4224 has been resolved in the latest AWS Lambda base image scans, indicating a patch or remediation has been applied.

Lambda Watchdog@LambdaWatchdogDisclosure

A new medium‑severity vulnerability, CVE‑2026‑4224, affecting Python in seven AWS Lambda base images has been reported, with links to issue details but no PoC, exploit, or patch information disclosed.

CVE@CVEnewDisclosure

The message announces CVE‑2026‑4224, describing a stack overflow in Expat’s DTD handling; it provides technical details but no PoC, exploitation evidence, patches, or debunking claims.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A new CVE‑2026‑4224 about a stack overflow in XML parsing with nested DTD content models is announced, with a link to an Intel report.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE‑2026‑4224, a stack overflow vulnerability triggered by deeply nested DTD XML, but provides no PoC, exploit tools, evidence of active use, or patch information.