Element.findall() and Element.iterfind() in CPython’s xml.etree.ElementPath implementation have a quadratic O(n^2) time complexity when an XPath index predicate (e.g. [1], [last()], or [last()-N]) is used on a node with many same‑tag siblings. Because the parser scans each sibling to evaluate the predicate, processing a large document can consume CPU and memory, potentially causing the application to hang or crash. The vulnerability is a performance flaw (CWE‑407).

The Python Software Foundation’s CPython implementation is affected. Any CPython release that has not incorporated the commits referenced (02c08e6b02…, 2ffab08378…, 390337b8ba…, cb409342a…) is potentially vulnerable. Systems that parse XML with Element.findall() or Element.iterfind() and use XPath index predicates are at risk.

The vulnerability aligns with CWE‑407 and CWE‑770. The CVSS score of 2.0 indicates low severity, and the EPSS score of less than 1% shows very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited real-world impact. However, an attacker who can supply crafted XML containing many same‑tag siblings and an index predicate can trigger the quadratic traversal, leading to a performance‑based denial of service. The attack vector is likely local or remote where the application processes external XML payloads.