CVE-2026-6879
lowPriorität · verfolgen · 0EPSS 0.004 · 29. PerzentilEUFRUSEPSS · bewertet 2026-10-28
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (21)
Betroffene Produkte und Versionsbereiche.
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- BIT-libpython-2026-6879Quadratic Behavior in xml.etree.ElementPath Index Predicates2026-08-17vendor · osvUS
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
- BIT-python-2026-6879Quadratic Behavior in xml.etree.ElementPath Index Predicates2026-08-17vendor · osvUS
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
- BIT-python-min-2026-6879Quadratic Behavior in xml.etree.ElementPath Index Predicates2026-08-17vendor · osvUS
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PSF-2026-342026-07-28vendor · osvUS
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-2026-38913134cnnvd
- EUVD-2026-49850enisa_euvd
- GHSA-77qw-3xm6-r2ppenisa_euvd
- BIT-libpython-2026-6879osv
- BIT-python-2026-6879osv
- BIT-python-min-2026-6879osv
- PSF-2026-34osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (25)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0cnnvd
- https://github.com/python/cpython/issues/152674cnnvd
- https://github.com/python/cpython/pull/152676cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/cnnvd
- https://www.python.org/Patchcnnvd
- https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81enisa_euvd
- https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85enisa_euvd
- https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan