Repository navigation
[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363
Description
Activity
Hi, do you know the usual timeline for including a newer Expat release in Python distributions? Python 3.13 and 3.14 were released yesterday, but they don’t include this upgrade. Many thanks!
@dkoszewski https://peps.python.org/pep-0719/#source-only-security-fix-releases reads "Provided irregularly on an as-needed basis until October 2029" which I read as "there is no usual". The key question to me would be how your distributor of CPython binaries builds CPython and whether you are even using the Expat bundled with CPython; e.g. for me system-wide Expat is used…
# python3 -c 'import pyexpat; print(pyexpat.__file__)' | xargs -n1 lddtree | grep libexpat libexpat.so.1 => /usr/lib64/libexpat.so.1
…and then the updates to system Expat are the answer.
I'm fairly certain we'll get it in by the next release, apologies!
Reacted by Damian Koszewski, PhD- added a commit that references this issue
on Feb 5, 2026 2 remaining items
Bug report
Bug description:
Hello! 👋
Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210).
The CPython issue for previous 2.7.3 was #139312 and the related merged main pull request was #139319, in case you want to have a look. (The
Dockerfilefrom comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)Thanks in advance!
CPython versions tested on:
3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch
Operating systems tested on:
Linux, macOS, Windows, Other
Linked PRs