VDB
CVE-2026-6879
CVE-2026-6879
PUBLISHED
CVSS 2 LOW
Reported by PSF · Published July 28, 2026
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Risk Scores
CVSS 4.0
2
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0, 3.11.0, 3.12.0 |
| Python Software Foundation | CPython | 0, 0, 3.12.0 |
| wolfi | python-3.10 | 0, 0, 0 |
| chainguard | python-3.13 | 0, 0 |
| wolfi | python-3.11 | 0, 0, 0 |
| wolfi | python-3.14 | 0, 0, 0 |
| chainguard | python-3.11 | 0 |
| wolfi | python-3.13 | 0, 0, 0 |
| chainguard | python-3.10 | 0 |
| wolfi | python-3.12 | 0, 0, 0 |
| alpine | python3 | 0, 0, 0 |
| chainguard | python-3.14 | 0, 0 |
| chainguard | python-3.12 | 0 |
Timeline
- Jul 28, 2026 CVE Published
- Jul 29, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
- Aug 11, 2026 CVE Updated
- Aug 23, 2026 Security Advisory