Hi, The following vulnerability was published for pypy3. CVE-2026-6879[0]: | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit | `O(n^2)` time complexity when using XPath index predicates (e.g. | `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag | siblings. `Element.find()` is only affected when the first match is | near the end of the sibling list, such as with `[last()]` or | `[last()-N]`; `.//item[1]` short-circuits after the first match. https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/ https://github.com/python/cpython/issues/152674 https://github.com/python/cpython/pull/152676 Fix in cpython: https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 (main) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-6879 https://www.cve.org/CVERecord?id=CVE-2026-6879 Please adjust the affected versions in the BTS as needed.