UBUNTU-CVE-2026-6879

HIGH7.1

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-ta

Published Jul 28, 2026

Modified 2 weeks ago

Details

Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end of the sibling list, such as with [last()] or [last()-N]; .//item[1] short-circuits after the first match.

Affected Packages

pypy3

Ubuntu 20.04 LTS

Affected versions:

7.1.1+dfsg-17.2.0+dfsg-17.3.0+dfsg-17.3.0+dfsg-1ubuntu27.3.0+dfsg-1ubuntu37.3.1+dfsg-47.3.1+dfsg-4ubuntu0.1

References

REPORT

https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0

REPORT

https://github.com/python/cpython/issues/152674

REPORT

https://github.com/python/cpython/pull/152676