CyberRota Analysis
AI-GeneratedThe vulnerability affects the `Element.findall()` and `Element.iterfind()` methods in XML processing, which can lead to significant performance degradation due to an O(n^2) time complexity when using XPath index predicates on XML documents with numerous same-tag siblings. This can result in denial-of-service conditions as the processing time increases dramatically with larger datasets. Developers and organizations utilizing these XML processing methods in performance-critical applications should prioritize addressing this issue to mitigate potential slowdowns or service interruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.