Python CPython O(n^2) XPath index in Element.findall()/iterfind (pre-3.15)
CVE-2026-6879 Published on July 28, 2026

Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-6879 can be exploited with network access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
HIGH
User Interaction:
PASSIVE

Weakness Type

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.


Products Associated with CVE-2026-6879

Want to know whenever a new CVE is published for Cpython? stack.watch will email you.

 

Affected Versions

Python Software Foundation CPython: