CVE-2026-6879

Public on 2026-07-28
Modified on 2026-09-10
Description
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
Severity
Low severity
Low
See what this means
CVSS v3 Base Score
3.7
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core python Pending Fix
Amazon Linux 2 - Core python3 Pending Fix
Amazon Linux 2023 python3.11 2026-08-31 ALAS2023-2026-2125 Fixed
Amazon Linux 2023 python3.12 2026-08-31 ALAS2023-2026-2124 Fixed
Amazon Linux 2023 python3.13 2026-08-31 ALAS2023-2026-2123 Fixed
Amazon Linux 2023 python3.14 2026-08-31 ALAS2023-2026-2122 Fixed
Amazon Linux 2027 Preview python3.14 Not Affected
Amazon Linux 2023 python3.9 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L