diff --git a/meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch b/meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
new file mode 100644
index 0000000000..c619b2b2b5
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
@@ -0,0 +1,87 @@
+From 2851ff7d51681201c950554d52697429413835b5 Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Fri, 10 Apr 2026 10:13:03 +0200
+Subject: [PATCH] LP#2146291: Set "resolve_entities='internal'" as default for
+ all parser subclasses.
+
+CVE: CVE-2026-41066
+Upstream-Status: Backport [https://github.com/lxml/lxml/commit/ab431ea0b9a7357d968f1d1c5c614649e9aaf358]
+
+(cherry picked from commit ab431ea0b9a7357d968f1d1c5c614649e9aaf358)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ src/lxml/iterparse.pxi | 10 ++++++----
+ src/lxml/parser.pxi    |  6 +++---
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/src/lxml/iterparse.pxi b/src/lxml/iterparse.pxi
+index 42b75249..9b6ceb00 100644
+--- a/src/lxml/iterparse.pxi
++++ b/src/lxml/iterparse.pxi
+@@ -6,7 +6,8 @@ cdef class iterparse:
+     """iterparse(self, source, events=("end",), tag=None, \
+                   attribute_defaults=False, dtd_validation=False, \
+                   load_dtd=False, no_network=True, remove_blank_text=False, \
+-                  remove_comments=False, remove_pis=False, encoding=None, \
++                  compact=True, resolve_entities='internal', remove_comments=False, \
++                  remove_pis=False, strip_cdata=True, encoding=None, \
+                   html=False, recover=None, huge_tree=False, schema=None)
+ 
+     Incremental parser.
+@@ -42,10 +43,11 @@ cdef class iterparse:
+      - remove_blank_text: discard blank text nodes
+      - remove_comments: discard comments
+      - remove_pis: discard processing instructions
+-     - strip_cdata: replace CDATA sections by normal text content (default: 
++     - strip_cdata: replace CDATA sections by normal text content (default:
+        True for XML, ignored otherwise)
+      - compact: safe memory for short text content (default: True)
+-     - resolve_entities: replace entities by their text value (default: True)
++     - resolve_entities: replace entities by their text value
++       (default: 'internal' only)
+      - huge_tree: disable security restrictions and support very deep trees
+                   and very long text content (only affects libxml2 2.7+)
+      - html: parse input as HTML (default: XML)
+@@ -68,7 +70,7 @@ cdef class iterparse:
+     def __init__(self, source, events=("end",), *, tag=None,
+                  attribute_defaults=False, dtd_validation=False,
+                  load_dtd=False, no_network=True, remove_blank_text=False,
+-                 compact=True, resolve_entities=True, remove_comments=False,
++                 compact=True, resolve_entities='internal', remove_comments=False,
+                  remove_pis=False, strip_cdata=True, encoding=None,
+                  html=False, recover=None, huge_tree=False, collect_ids=True,
+                  XMLSchema schema=None):
+diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi
+index 3106e610..ba9875c0 100644
+--- a/src/lxml/parser.pxi
++++ b/src/lxml/parser.pxi
+@@ -1584,7 +1584,7 @@ cdef class XMLParser(_FeedParser):
+     """XMLParser(self, encoding=None, attribute_defaults=False, dtd_validation=False, \
+                  load_dtd=False, no_network=True, decompress=False, ns_clean=False, \
+                  recover=False, schema: XMLSchema =None, huge_tree=False, \
+-                 remove_blank_text=False, resolve_entities=True, \
++                 remove_blank_text=False, resolve_entities='internal', \
+                  remove_comments=False, remove_pis=False, strip_cdata=True, \
+                  collect_ids=True, target=None, compact=True)
+ 
+@@ -1717,7 +1717,7 @@ cdef class ETCompatXMLParser(XMLParser):
+     """ETCompatXMLParser(self, encoding=None, attribute_defaults=False, \
+                  dtd_validation=False, load_dtd=False, no_network=True, decompress=False, \
+                  ns_clean=False, recover=False, schema=None, \
+-                 huge_tree=False, remove_blank_text=False, resolve_entities=True, \
++                 huge_tree=False, remove_blank_text=False, resolve_entities='internal', \
+                  remove_comments=True, remove_pis=True, strip_cdata=True, \
+                  target=None, compact=True)
+ 
+@@ -1731,7 +1731,7 @@ cdef class ETCompatXMLParser(XMLParser):
+     def __init__(self, *, encoding=None, attribute_defaults=False,
+                  dtd_validation=False, load_dtd=False, no_network=True, decompress=False,
+                  ns_clean=False, recover=False, schema=None,
+-                 huge_tree=False, remove_blank_text=False, resolve_entities=True,
++                 huge_tree=False, remove_blank_text=False, resolve_entities='internal',
+                  remove_comments=True, remove_pis=True, strip_cdata=True,
+                  target=None, compact=True):
+         XMLParser.__init__(self,
+-- 
+2.53.0
+
diff --git a/meta/recipes-devtools/python/python3-lxml_6.0.2.bb b/meta/recipes-devtools/python/python3-lxml_6.0.2.bb
index 876fda93b6..75894460ec 100644
--- a/meta/recipes-devtools/python/python3-lxml_6.0.2.bb
+++ b/meta/recipes-devtools/python/python3-lxml_6.0.2.bb
@@ -20,7 +20,9 @@ DEPENDS += "libxml2 libxslt"
 
 SRC_URI[sha256sum] = "cd79f3367bd74b317dda655dc8fcfa304d9eb6e4fb06b7168c5cf27f96e0cd62"
 
-SRC_URI += "${PYPI_SRC_URI}"
+SRC_URI += "${PYPI_SRC_URI} \
+            file://CVE-2026-41066.patch"
+
 inherit pkgconfig pypi setuptools3
 
 # {standard input}: Assembler messages: