CVE-2026-6879 in Python
Summary
by MITRE • 07/28/2026
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability represents a critical performance degradation issue in Python's xml.etree.ElementTree library that manifests when processing XML documents containing numerous sibling elements with identical tags. The flaw specifically impacts the Element.findall() method and fully-consumed Element.iterfind() operations when employing XPath index predicates such as [1], [last()], or [last()-N]. The underlying technical mechanism stems from how these methods handle index-based selection within XML structures, creating a quadratic time complexity scenario that dramatically slows processing times as document size increases. When an XPath expression containing index predicates is applied to elements with many siblings sharing the same tag name, the library performs redundant operations that scale exponentially rather than linearly with document size.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially enable denial-of-service conditions in applications that process large XML documents or handle user-provided XML data. Attackers could exploit this weakness by crafting malicious XML payloads containing thousands or millions of sibling elements with identical tags, causing significant computational overhead when XPath index predicates are applied. This vulnerability particularly affects web applications, data processing systems, and any software that relies on ElementTree for XML parsing operations, especially in environments where XML input is not properly sanitized or validated.
The root cause of this issue aligns with CWE-798, which addresses the use of hard-coded credentials and weak configurations, though in this case it manifests as a performance configuration flaw in XML processing libraries. From an adversary perspective, this vulnerability maps to ATT&CK technique T1496, specifically involving resource exhaustion attacks that consume system resources through inefficient algorithms. The vulnerability's exploitable nature increases when applications process external XML input without proper input validation or when they perform repeated XPath queries on large datasets.
Mitigation strategies should focus on both immediate code-level fixes and architectural considerations. Developers should avoid using index predicates in XPath expressions whenever possible, particularly in scenarios involving large sibling lists, and instead implement alternative approaches such as limiting the scope of searches or using more specific path expressions. Input validation and sanitization measures must be implemented to prevent malicious XML structures from being processed, including limiting the number of sibling elements in documents that will undergo XPath processing. Additionally, applications should consider implementing timeouts for XML processing operations and monitoring resource consumption patterns to detect potential exploitation attempts. Organizations should also evaluate upgrading to Python versions where this specific issue has been addressed through improved algorithmic implementations or by switching to alternative XML processing libraries such as lxml that handle these scenarios more efficiently.