CVE-2026-6879
Quadratic Behavior in xml.etree.ElementPath Index Predicates
CVSS Score
0.0
EPSS Score
0.3%
EPSS Percentile
22th
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
| Vendor | python software foundation |
| Product | cpython |
| Published | Jul 28, 2026 |
| Last Updated | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.13.15 3.14.0 < 3.14.7 3.15.0a1 < 3.15.0rc1
References
github.com: https://github.com/python/cpython/pull/152676 github.com: https://github.com/python/cpython/issues/152674 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/ github.com: https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 github.com: https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81 github.com: https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db github.com: https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3 github.com: https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02
Credits
🔍 dm (https://github.com/DarkaMaul) Petr Viktorin (https://github.com/encukou)