@@ -27,14 +27,14 @@ _Py_HashPointerRaw(const void *ptr)
 *   pppppppp ssssssss ........  fnv -- two Py_hash_t
 *   k0k0k0k0 k1k1k1k1 ........  siphash -- two uint64_t
 *   ........ ........ ssssssss  djbx33a -- 16 bytes padding + one Py_hash_t
- *   ........ ........ eeeeeeee  pyexpat XML hash salt
 *
 * memory layout on 32 bit systems
 *   cccccccc cccccccc cccccccc  uc
 *   ppppssss ........ ........  fnv -- two Py_hash_t
 *   k0k0k0k0 k1k1k1k1 ........  siphash -- two uint64_t (*)
 *   ........ ........ ssss....  djbx33a -- 16 bytes padding + one Py_hash_t
- *   ........ ........ eeee....  pyexpat XML hash salt
 *
 * (*) The siphash member may not be available on 32 bit platforms without
 *     an unsigned int64 data type.
@@ -58,7 +58,9 @@ typedef union {
        Py_hash_t suffix;
    } djbx33a;
    struct {
-        unsigned char padding[16];
        Py_hash_t hashsalt;
    } expat;
} _Py_HashSecret_t;

diff --git a/Include/pyexpat.h b/Include/pyexpat.h
@@ -62,6 +62,9 @@ struct PyExpat_CAPI
        XML_Parser parser, unsigned long long activationThresholdBytes);
    XML_Bool (*SetBillionLaughsAttackProtectionMaximumAmplification)(
        XML_Parser parser, float maxAmplificationFactor);
    /* always add new stuff to the end! */
};

diff --git a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
@@ -0,0 +1,3 @@
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -3728,8 +3728,12 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *target,
        PyErr_NoMemory();
        return -1;
    }
-    /* expat < 2.1.0 has no XML_SetHashSalt() */
-    if (EXPAT(st, SetHashSalt) != NULL) {
        EXPAT(st, SetHashSalt)(self->parser,
                           (unsigned long)_Py_HashSecret.expat.hashsalt);
    }