Executive brief
A performance vulnerability exists in the Python standard library's XML processing component. When an application uses certain search functions to find specific items in a large XML document, it may take an excessively long time to process, potentially leading to a denial-of-service condition where the application becomes unresponsive. This occurs specifically when searching for elements by their position (like the 'last' item) in documents containing many similar tags.
Technical details
A vulnerability in CPython's xml.etree.ElementTree module causes Element.findall() and Element.iterfind() to exhibit O(n^2) time complexity when using XPath index predicates such as [1], [last()], or [last()-N]. The issue occurs when processing XML documents containing a large number of same-tag siblings. While Element.find() typically short-circuits, it remains vulnerable if the requested index is near the end of a long sibling list. An attacker could exploit this by providing a specially crafted XML document to an application that performs XPath queries on untrusted input, leading to CPU exhaustion. The issue has been addressed in CPython 3.15.0 and backported to earlier supported versions.
Affected products
- Python Software Foundation CPython < 3.15.0
Timeline
- 2026-06-30: disclosed: Issue reported privately and initial PR opened.
- 2026-07-28: patched: Fixes merged into CPython main branch.
- 2026-07-28: advisory: Public advisory published by Python Software Foundation.