CVE-2026-6879
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The `Element.findall()` and `Element.iterfind()` methods in the XML parser have O(n^2) time complexity when using XPath index predicates on documents with many siblings. `Element.find()` is only affected when searching for last matches.
Risk Assessment
Processing large XML documents can cause significant slowdown or resource exhaustion, enabling a DoS attack.
Recommendation
Avoid using XPath index predicates on documents with many siblings or limit the size of processed XML documents.
Original NVD description (English source)
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.