VULNERABILITY INTELLIGENCE
CVE-2026-6879
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-07-28
Last modified2026-10-24
Description
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-407