Unrated severityNVD Advisory· Published Jul 29, 2026
Debian python3.13: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` tim…
CVE-2026-6879
Description
Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end of the sibling list, such as with [last()] or [last()-N]; .//item[1] short-circuits after the first match.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.