CVE-2026-41066: lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

Overview

Severity
High (CVSS 7.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploit Status
Not Exploited
Patch Tuesday
2026-Apr
Released
2026-04-26
Last Updated
2026-05-06
EPSS Score
0.06% (percentile: 19.0%)

Affected Products (3)

Open Source Software

  • azl3 python-lxml 4.9.3-1 on Azure Linux 3.0

Mariner

  • cbl2 python-lxml 4.9.1-1 on CBL Mariner 2.0

Other

  • 21313-17084

Revision History

  • 2026-04-26: Information published.
  • 2026-04-27: Information published.
  • 2026-04-29: Information published.
  • 2026-05-06: Information published.
  • 2026-05-06: Information published.