CVE-2026-6879
LOW
2,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0026
Percentile
0,2th
Updated
Single Data Point
Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.
407
Inefficient Algorithmic Complexity
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2…
https://github.com/python/cpython/issues/152674
https://github.com/python/cpython/pull/152676
https://mail.python.org/archives/list/[email protected]/thread/7YMZ6…