Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-14647

30
FAUCET Score

CVE-2018-14647 describes a denial-of-service vulnerability in Python's elementtree C accelerator, affecting Python versions 2.7.0-2.7.15, 3.4.0-3.4.9, 3.5.0-3.5.6, 3.6.0-3.6.6, and 3.7.0, as well as distributions like Debian and Red Hat. This high-severity vulnerability (CVSS 7.5) allows unauthenticated attackers to trigger pathological hash collisions in Expat by crafting malicious XML documents, leading to significant CPU and RAM consumption. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.7.0, <= 2.7.15CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.4.0, <= 3.4.9CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.5.0, <= 3.5.6CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.6.0, <= 3.6.6CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
3.7.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.7.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

5.3MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
11.30%
Probability of exploitation in next 30 days
EPSS Percentile
95.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.1130 is in the 93rd percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

nodejspatch availablevia llm_extracted
View patch
pjsippatch availablevia llm_extracted
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: python-0:2.7.5-86.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: python-0:2.7.5-63.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: python-0:2.7.5-63.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: python-0:2.7.5-63.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.5 Extended Update SupportFixed in: python-0:2.7.5-74.el7_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Extended Update SupportFixed in: python-0:2.7.5-83.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-0:2.7.16-4.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-jinja2-0:2.6-12.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python36-python-0:3.6.9-2.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-0:2.7.16-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-jinja2-0:2.6-15.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-34/ansible-tower-memcached:1.4.15-28
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: python27-python-0:2.7.16-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: python27-python-jinja2-0:2.6-15.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: python27-python-0:2.7.16-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: python27-python-jinja2-0:2.6-15.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-python36-python-0:3.6.9-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-0:2.7.16-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-jinja2-0:2.6-15.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python36-python-0:3.6.9-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python36-python-0:3.6.9-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python36-python-0:3.6.9-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-35/ansible-tower-memcached:1.4.15-28
View patch
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-python35-python
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: python
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: python

Vendor Advisories (3)

nodejsllm-nodejs-302528ae26f0d946CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
pjsipllm-pjsip-7ba3ec379210ac70CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
redhatCVE-2018-14647Moderate

python: Missing salt initialization in _elementtree.c module

Sep 22, 2018

References

lists.opensuse.org / opensuse-security-announce/2020-01/msg00040.html
Mailing ListThird Party Advisory
access.redhat.com / errata/RHSA-2019:1260
Third Party Advisory
access.redhat.com / errata/RHSA-2019:2030
Third Party Advisory
access.redhat.com / errata/RHSA-2019:3725
Third Party Advisory
bugs.python.org / issue34623
Issue TrackingPatchVendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
lists.apache.org / thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
lists.debian.org / debian-lts-announce/2019/06/msg00022.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2019/06/msg00023.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5
usn.ubuntu.com / 3817-1
Third Party Advisory
usn.ubuntu.com / 3817-2
Third Party Advisory
debian.org / security/2018/dsa-4306
Third Party Advisory
debian.org / security/2018/dsa-4307
Third Party Advisory
securityfocus.com / bid/105396
Third Party AdvisoryVDB Entry
securitytracker.com / id/1041740
Third Party AdvisoryVDB Entry