EUVD-2026-49850
GHSA-77qw-3xm6-r2pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft XML with many siblings
-
DeliverySubmit to vulnerable application
-
ExploitXPath predicate evaluation triggers O(n^2) processing
-
ExecutionHigh CPU consumption
-
ImpactService unavailability
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The attack requires that the application uses Element.findall(), iterfind(), or find() with XPath index predicates (such as [1] or [last()]) on XML input containing many same-tag siblings. Additionally, the attacker must have high privileges to deliver the crafted XML, and user interaction is required (e.g., loading the file or triggering parsing). The attack vector is network (AV:N) but with high complexity and prerequisites. No default configuration is exploitable without these specific conditions. |
| Impact | CVSS 4.0 base score 2.0 indicates very low severity, with AV:N/AC:H/AT:P/PR:H/UI:P and only VA:L impact. No EPSS, KEV, or public exploit information is available. The high attack complexity, required high privileges, and user interaction make this a low real-world risk despite the potential for denial of service. The risk is only relevant in environments where untrusted XML with many siblings is processed via XPath index predicates in vulnerable CPython versions. |
| Exploit ScenarioDerived | An attacker crafts an XML document with thousands of identical sibling elements and an XPath expression like .//item[last()]. This document is loaded by a vulnerable application (requiring high privileges and user interaction), causing ElementFind() to perform repeated full scans and consume excessive CPU, leading to denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
RemediationAI
Upgrade to CPython version 3.15.0 or apply the commit 2ffab083782968a4d732738f4f1dff6bbd69d2b0. Workarounds include avoiding the use of XPath index predicates (e.g., [1], [last()]) on XML documents with many same-tag siblings, or using alternative traversal methods like direct iteration. The patch adds caching to eliminate the quadratic behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the ElementPath implementation within CPython's xml.etree.ElementTree module, which lacks caching for XPath index predicates like [1] or [last()]. When iterating over a large number of sibling elements, each predicate evaluation triggers a full search of the sibling list, leading to O(n^2) time complexity. This is an algorithmic inefficiency related to CWE-400 (Uncontrolled Resource Consumption). The affected product is CPython (CPE: cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*), the reference implementation of Python.
Know when Cpython gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (PSF) · only source for this CVE.
CVSS VectorVendor: PSF
DescriptionCVE.org
Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end of the sibling list, such as with [last()] or [last()-N]; .//item[1] short-circuits after the first match.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
Exploit-DB