XPath Index Predicate Performance Issues in Python's XML Processing Library

CVE-2026-6879

What is CVE-2026-6879?

The Python XML processing library's Element.findall() and fully-consumed Element.iterfind() methods demonstrate inefficient O(n^2) time complexity when handling XPath index predicates in XML documents that contain numerous sibling elements with the same tag. This performance degradation becomes pronounced when queries involve predicates like [1], [last()], or [last()-N]. The Element.find() method experiences the same inefficiency under specific conditions where the first match is located towards the end of the sibling list. Developers should be aware of these performance issues while designing XML queries with potential large sibling structures.

References