CVE-2026-6879: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-6879 is a denial-of-service vulnerability in Python's xml.etree.ElementTree module caused by quadratic (O(n²)) time complexity when processing XPath index predicates. Specifically, Element.findall() and fully-consumed Element.iterfind() exhibit this behavior when using predicates such as [1], [last()], or [last()-N] on XML documents with many same-tag sibling elements. The vulnerability affects CPython versions prior to 3.13.15, 3.14.0–3.14.6, and 3.15.0a1–3.15.0b (pre-release). It was reported privately by @DarkaMaul, opened as a GitHub issue on June 30, 2026, and published on July 28, 2026. It carries a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, CPython Issue).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity). In Lib/xml/etree/ElementPath.py, the select() function for index predicates previously called parent.findall(elem.tag) on every iteration over matching elements, resulting in O(n²) total work when n same-tag siblings exist. The fix introduces a per-query cache keyed on (parent, elem.tag) so that findall is called at most once per unique parent-tag combination, reducing complexity to O(n). Exploitation requires an attacker to supply a crafted XML document with a large number of same-tag sibling elements to an application that processes it using XPath index predicates (CPython PR, CPython Commit).

Successful exploitation causes CPU exhaustion and application hangs, degrading or completely denying service to legitimate users. There is no impact on confidentiality or integrity — only availability is affected. Applications that parse untrusted XML input using Python's xml.etree.ElementTree with XPath index predicates are at risk, particularly web services or APIs that accept user-supplied XML (GitHub Advisory, CPython Issue).

No public exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.0026 (0.26%), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to be able to supply malicious XML to an application using the affected API, which may require elevated privileges or specific application access depending on the deployment (GitHub Advisory).

1. Identify a target application: Find a Python application that accepts user-supplied XML input and processes it using Element.findall(), Element.iterfind(), or Element.find() with XPath index predicates (e.g., .//item[1], .//item[last()]).
2. Craft a malicious XML document: Construct an XML document containing a root element with a very large number (e.g., tens of thousands) of same-tag child elements, such as <root><item/><item/>...<item/></root> with N repetitions.
3. Submit the XML to the target: Send the crafted XML to the application via its input mechanism (e.g., HTTP request body, file upload, API call).
4. Trigger quadratic processing: The application parses the XML and evaluates an XPath index predicate over the many siblings, causing O(n²) findall calls that exhaust CPU resources and cause the process to hang or become unresponsive (CPython Issue, CPython PR).

• Process: Python processes consuming abnormally high CPU for extended periods while handling XML parsing tasks.
• Logs: Application logs showing unusually long response times or timeouts on endpoints that process XML input; repeated or hung requests associated with XML parsing operations.
• Network: Large XML payloads submitted to application endpoints, particularly those containing many repeated sibling elements under a single parent tag.

Upgrade CPython to a patched version: 3.13.15 or later (for the 3.13 branch), 3.14.7 or later (for the 3.14 branch), or 3.15.0rc1 or later (for the 3.15 pre-release branch). Backport patches have also been applied to the 3.10, 3.11, and 3.12 branches. As a workaround where upgrading is not immediately possible, applications should validate and limit the size and structure of XML input before processing, or avoid using XPath index predicates on untrusted XML with potentially large sibling sets. Microsoft has also issued a patch for affected Azure Linux 3 Python packages (CPython PR, Microsoft MSRC).

The vulnerability was reported privately to the Python Security team by researcher @DarkaMaul and handled through responsible disclosure. The fix was reviewed and approved by CPython core developer serhiy-storchaka before being merged. Coverage has been limited to standard vulnerability tracking platforms (VulnDB, Vulners, INCIBE, OSV) with no notable broader media or social media discussion, consistent with the low severity rating (CPython Issue, CPython PR).