CVE-2026-6879: Quadratic Behavior in xml.etree.ElementPath Index Predicates
Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end of the sibling list, such as with [last()] or [last()-N]; .//item[1] short-circuits after the first match.
Other sources
Quadratic Behavior in xml.etree.ElementPath Index Predicates
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6879?
CVE-2026-6879 has been assigned a risk score of 20, indicating a significant vulnerability.
How do I fix CVE-2026-6879?
To mitigate CVE-2026-6879, consider optimizing your XPath queries to avoid heavy use of index predicates on documents with many same-tag siblings.
What components are affected by CVE-2026-6879?
CVE-2026-6879 specifically affects the xml.etree.ElementPath module used in XML parsing.
What is the impact of CVE-2026-6879 on performance?
CVE-2026-6879 leads to O(n^2) time complexity, which can significantly degrade performance when processing large XML documents.
When was CVE-2026-6879 published?
CVE-2026-6879 was published on July 28, 2026.