Quadratic Complexity Vulnerability in Python xml.etree.ElementPath

CVE-2026-6879 describes a performance-based vulnerability within the Python xml.etree.ElementPath module. The issue arises from the way the module handles index predicates during XML path traversal, which can lead to quadratic time complexity (O(n²)) when processing specifically formatted, malicious XML inputs. By supplying a deeply nested or specifically structured XPath expression with complex index predicates, an attacker can induce high CPU utilization and exhaust system resources, resulting in a denial-of-service (DoS) condition for applications that rely on this library for XML parsing. Because this module is part of the standard Python library, the vulnerability impacts a wide range of applications that perform untrusted XML input processing across Windows, Linux, and macOS environments. This vulnerability does not provide remote code execution but acts as a significant availability risk for services processing user-provided XML data.

Impact

Successful exploitation results in a denial-of-service condition due to CPU exhaustion during the parsing of malicious XML documents. This impacts any service, web application, or backend utility that utilizes the standard xml.etree.ElementPath implementation to process untrusted XML content, potentially leading to service degradation or application crashes in affected environments.

Recommendation

Prioritized actions for security teams:

• Identify applications and internal services that utilize the xml.etree.ElementPath module to parse untrusted or externally-sourced XML files.
• Patch Python installations to the versions provided by the Python Software Foundation that address CVE-2026-6879.
• Implement resource limiting or timeout policies on services that process XML data to mitigate the impact of potential CPU exhaustion attacks until patching is completed.