EUVD-2026-49850
GHSA-77qw-3xm6-r2pp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (PSF) · only source for this CVE.
CVSS VectorVendor: PSF
Lifecycle Timeline
3DescriptionCVE.org
Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end of the sibling list, such as with [last()] or [last()-N]; .//item[1] short-circuits after the first match.
AnalysisAI
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lies in the ElementPath implementation within CPython's xml.etree.ElementTree module, which lacks caching for XPath index predicates like [1] or [last()]. When iterating over a large number of sibling elements, each predicate evaluation triggers a full search of the sibling list, leading to O(n^2) time complexity. This is an algorithmic inefficiency related to CWE-400 (Uncontrolled Resource Consumption). The affected product is CPython (CPE: cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*), the reference implementation of Python.
RemediationAI
Upgrade to CPython version 3.15.0 or apply the commit 2ffab083782968a4d732738f4f1dff6bbd69d2b0. Workarounds include avoiding the use of XPath index predicates (e.g., [1], [last()]) on XML documents with many same-tag siblings, or using alternative traversal methods like direct iteration. The patch adds caching to eliminate the quadratic behavior.
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today