CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

What is CVE-2026-6879?

CVE-2026-6879 is a low-severity denial of service vulnerability in CPython, published on 28 Jul 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.

Weakness: CWE-407

Which versions are affected by CVE-2026-6879?

3 open source packages ship an affected version, including libpython, python and python-min.

How do I fix CVE-2026-6879?

Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.15.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-6879 being exploited?

There is no known exploitation of CVE-2026-6879 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-6879, AZL-94157, AZL-94299, BELL-CVE-2026-6879, BIT-libpython-2026-6879, BIT-python-2026-6879 and 20 more.