The vulnerability CVE-2026-4224 affects CPython's XML parsing functionality when using the Expat parser with an ElementDeclHandler registered. Parsing an inline DTD with a deeply nested content model triggers a C stack overflow, which can crash the interpreter or cause denial of service. The issue is classified under CWE-674 (Improper Control of a Resource Through a Reference to a Resource in Another Sphere). The CVSS 4.0 base score is 6.0 (medium severity), with network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on availability. The vulnerability is published and assigned by the Python Software Foundation but no patch or remediation details are provided in the source data.

Successful exploitation of this vulnerability results in a C stack overflow during XML parsing, which can cause the Python interpreter to crash or become unavailable. This impacts availability but does not indicate confidentiality or integrity loss. The vulnerability requires partial privileges and no user interaction, with network attack vector, making remote exploitation feasible under certain conditions.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is available, avoid parsing untrusted XML data with Expat parsers that register ElementDeclHandler callbacks or implement application-level input validation to prevent deeply nested DTD content models.