VYPR
Unrated severityNVD Advisory· Published Jul 29, 2026

Debian python3.13: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` tim…

CVE-2026-6879

Description

Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end  of the sibling list, such as with [last()] or [last()-N].//item[1] short-circuits after the first match.

Affected products

1

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.