CVE-2026-6879
Low
Description
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
SeverityLow
CVSS2.0
Exploit probability—
ProductCPython
PublishedJul 28, 2026
First seenJul 28, 2026
Weakness typeCWE-407CWE-407
How to fix
Update
- Python Software Foundation CPython3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0rc1 or later
Patches
- github.com/python/cpython/pull/152676
- github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0
- github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81
- github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db
- github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3
- github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02
- github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85
- github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.10.21, 3.11.0 ≤ v < 3.11.16, 3.12.0 ≤ v < 3.12.14, 3.13.0 ≤ v < 3.13.15, 3.14.0 ≤ v < 3.14.7, 3.15.0a1 ≤ v < 3.15.0rc1 | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0rc1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.