Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-28T13:46:30 python: Python: Performance degradation in XML processing due to quadratic time complexity 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L CWE-770

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service (DoS) when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall() and Element.iterfind() can cause the processing time to increase quadratically with the size of the input, making the system unresponsive. A remote attacker could exploit this by providing a malicious XML file, potentially disrupting service availability.

Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48238 python3-14-main-3.14.6-2.2.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48246 python3-10-main-3.10.20-3.2.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48253 python3-11-main-3.11.15-5.5.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48278 python3-13-main-3.13.14-1.7.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48279 python3-12-main-3.12.13-3.8.hum1 https://www.cve.org/CVERecord?id=CVE-2026-6879 https://nvd.nist.gov/vuln/detail/CVE-2026-6879 https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 https://github.com/python/cpython/issues/152674 https://github.com/python/cpython/pull/152676 https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/