CVE-2026-6879

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Certain functions exhibit quadratic time complexity, denoted as O(n^2), when processing XML documents containing numerous siblings with the same tag. This occurs specifically when using XPath index predicates such as [1], [last()], or [last()-N]. The affected functions include Element.findall() and fully-consumed Element.iterfind(). Additionally, Element.find() is impacted when the first match is located near the end of the sibling list, such as when using [last()] or [last()-N], although .//item[1] short-circuits after the first match.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.