Vulnerability · Published Jul 28, 2026 · Assigned by PSF
CVE-2026-6879Quadratic Behavior in xml.etree.ElementPath Index Predicates
Low 2.0
In plain English
A low-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2026-6879 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-6879 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-6879 |
| Debian:14 | pypy3 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-6879 |
| Debian:12 | python3.11 | no fix listed | DEBIAN-CVE-2026-6879 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u5 | DEBIAN-CVE-2026-6879 |
| Debian:14 | python3.14 | 3.14.7-1 | DEBIAN-CVE-2026-6879 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-6879 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-6879 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.153.14.0 – before 3.14.73.15.0a1 – before 3.15.0rc1 |
Weakness: CWE-407 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/152676 patch
- https://github.com/python/cpython/issues/152674 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/ vendor-advisory
- https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 patch
- https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81 patch
- https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db patch
- https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3 patch
- https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02 patch
- https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85 patch
- https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70 patch