CVE-2026-6879: Python CPython quadratic complexity in xml.etree XPath index predicates

CVE-2026-6879 · Severity: info · CVSS 2 · Published 2026-07-28

A performance vulnerability exists in the Python standard library's XML processing component. When an application uses certain search functions to find specific items in a large XML document, it may take an excessively long time to process, potentially leading to a denial-of-service condition where the application becomes unresponsive. This occurs specifically when searching for elements by their position (like the 'last' item) in documents containing many similar tags.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-6879 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6879 being exploited in the wild.
How severe is CVE-2026-6879?
Informational severity, with a CVSS score of 2, published 28 July 2026.
Which products and versions are affected?
Python Software Foundation CPython < 3.15.0.
Is there a fix for CVE-2026-6879?
A patch was published on 2026-07-28: Fixes merged into CPython main branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6879 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6879?
Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in CPython's xml.etree.ElementTree module causes Element.findall() and Element.iterfind() to exhibit O(n^2) time complexity when using XPath index predicates such as [1], [last()], or [last()-N]. The issue occurs when processing XML documents containing a large number of same-tag siblings. While Element.find() typically short-circuits, it remains vulnerable if the requested index is near the end of a long sibling list. An attacker could exploit this by providing a specially crafted XML document to an application that performs XPath queries on untrusted input, leading to CPU exhaustion. The issue has been addressed in CPython 3.15.0 and backported to earlier supported versions.

Affected products

  • Python Software Foundation CPython < 3.15.0

Timeline

  • 2026-06-30: disclosed: Issue reported privately and initial PR opened.
  • 2026-07-28: patched: Fixes merged into CPython main branch.
  • 2026-07-28: advisory: Public advisory published by Python Software Foundation.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.