Repository navigation
[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363
Description
Bug report
Bug description:
Hello! 👋
Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210).
- Blog post: https://blog.hartwork.org/posts/expat-2-7-4-released/
- GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_4
- Change log: https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes
The CPython issue for previous 2.7.3 was #139312 and the related merged main pull request was #139319, in case you want to have a look. (The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)
Thanks in advance!
CPython versions tested on:
3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch
Operating systems tested on:
Linux, macOS, Windows, Other
Linked PRs
- gh-144363: Update bundled libexpat to 2.7.4 #144365
- [3.14] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144499
- [3.13] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144500
- [3.12] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144501
- [3.11] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144514
- [3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144515
Activity
dkoszewski commentedon Feb 4, 2026
Hi, do you know the usual timeline for including a newer Expat release in Python distributions? Python 3.13 and 3.14 were released yesterday, but they don’t include this upgrade. Many thanks!
hartwork commentedon Feb 4, 2026
@dkoszewski https://peps.python.org/pep-0719/#source-only-security-fix-releases reads "Provided irregularly on an as-needed basis until October 2029" which I read as "there is no usual". The key question to me would be how your distributor of CPython binaries builds CPython and whether you are even using the Expat bundled with CPython; e.g. for me system-wide Expat is used…
…and then the updates to system Expat are the answer.
StanFromIreland commentedon Feb 4, 2026
I'm fairly certain we'll get it in by the next release, apologies!
gh-144363: Update bundled libexpat to 2.7.4 (#144365)
pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-144365)
2 remaining items
pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)
[3.11] pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-14…
[3.10] pythongh-144363: Update bundled libexpat to 2.7.4 (pythonGH-14…
[3.14] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (GH-14…
[3.13] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (GH-14…
pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)
[3.12] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144501)
[3.11] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144514)
[3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144515)
pythongh-144363: Update bundled libexpat to 2.7.4 (python#144365)