GHSA-77qw-3xm6-r2ppLow

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when...

Published
July 28, 2026
Last Modified
August 11, 2026

🔗 CVE IDs covered (1)

📋 Description

Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time complexity when using XPath index predicates (e.g. [1], [last()], [last()-N]) on XML documents with many same-tag siblings. Element.find() is only affected when the first match is near the end  of the sibling list, such as with [last()] or [last()-N].//item[1] short-circuits after the first match.

🔗 References (12)