XPath Index Predicate Performance Issues in Python's XML Processing Library
CVE-2026-6879

2LOW

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
28 July 2026

What is CVE-2026-6879?

The Python XML processing library's Element.findall() and fully-consumed Element.iterfind() methods demonstrate inefficient O(n^2) time complexity when handling XPath index predicates in XML documents that contain numerous sibling elements with the same tag. This performance degradation becomes pronounced when queries involve predicates like [1], [last()], or [last()-N]. The Element.find() method experiences the same inefficiency under specific conditions where the first match is located towards the end of the sibling list. Developers should be aware of these performance issues while designing XML queries with potential large sibling structures.

Affected Version(s)

CPython 0 < 3.15.0

References

https://github.com/python/cpython/pull/152676
patch
https://github.com/python/cpython/issues/152674
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dm (https://github.com/DarkaMaul)
Petr Viktorin (https://github.com/encukou)
.