CVE-2026-6879
published 2026-07-28CVE-2026-6879: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`…
PriorityP413low2CVSS 4.0
AVNACHATPPRHUIPVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.37%
29.6th percentile
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python_software_foundation | cpython | < 3.10.21 | 3.10.21 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.16 | 3.11.16 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.14 | 3.12.14 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.15 | 3.13.15 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.7 | 3.14.7 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0rc1 | 3.15.0rc1 |
CVSS provenance
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python: Python: Performance degradation in XML processing due to quadratic time complexity
vendor_redhat·2026-07-28·CVSS 2.0
CVE-2026-6879 [LOW] CWE-770 python: Python: Performance degradation in XML processing due to quadratic time complexity
python: Python: Performance degradation in XML processing due to quadratic time complexity
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service (DoS) when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall() and Element.iterfind() can cause the processing time to
VulDB
PSF Python up to 3.14.x XPath Element.findall/Element.iterfind/Element.find resource consumption (EUVD-2026-49850)
vuldb·2026-08-10·CVSS 2.0
CVE-2026-6879 [LOW] PSF Python up to 3.14.x XPath Element.findall/Element.iterfind/Element.find resource consumption (EUVD-2026-49850)
A vulnerability has been found in PSF Python up to 3.14.x and classified as problematic. This affects the function Element.findall/Element.iterfind/Element.find of the component XPath. The manipulation leads to resource consumption.
This vulnerability is uniquely identified as CVE-2026-6879. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
GHSA
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g.
ghsa_unreviewed·2026-07-28
CVE-2026-6879 [LOW] CWE-407 `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g.
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8dbhttps://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3https://github.com/python/cpython/issues/152674https://github.com/python/cpython/pull/152676https://mail.python.org/archives/list/[email protected]/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/
2026-07-28
Published