#1147726 pypy3: CVE-2026-6879

Package:
src:pypy3
Source:
src:pypy3
Submitter:
Moritz Mühlenhoff
Date:
2026-09-14 19:05:05 UTC
Severity:
normal
Tags:
#1147726#5
Date:
2026-09-14 17:38:38 UTC
From:
To:
Hi,

The following vulnerability was published for pypy3.

CVE-2026-6879[0]:
| `Element.findall()` and fully-consumed `Element.iterfind()` exhibit
| `O(n^2)` time complexity when using XPath index predicates (e.g.
| `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag
| siblings. `Element.find()` is only affected when the first match is
| near the end  of the sibling list, such as with `[last()]` or
| `[last()-N]`;  `.//item[1]` short-circuits after the first match.

https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/
https://github.com/python/cpython/issues/152674
https://github.com/python/cpython/pull/152676

Fix in cpython:
https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 (main)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-6879
https://www.cve.org/CVERecord?id=CVE-2026-6879

Please adjust the affected versions in the BTS as needed.