CVE-2026-6879
Quadratic Behavior in xml.etree.ElementPath Index Predicates
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
| Vendor | python software foundation |
| Product | cpython |
| Published | Jul 28, 2026 |
| Last Updated | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.15.0
References
github.com: https://github.com/python/cpython/pull/152676 github.com: https://github.com/python/cpython/issues/152674 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/ github.com: https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0
Credits
🔍 dm (https://github.com/DarkaMaul) Petr Viktorin (https://github.com/encukou)