- CVE-2026-6879: xml.etree.ElementTree's find(), findall() and iterfind() had quadratic complexity when an XPath index predicate ([1], [last()], [last()-N]) was evaluated against a document with many same-tag siblings. The [index] selector called parent.findall(tag) once per candidate element, and each such call is itself linear in the number of siblings, allowing a CPU denial-of-service on untrusted XML or untrusted XPath (CWE-407, algorithmic complexity). Backport of cpython 2ffab083 (gh-152674) taken via the upstream 3.12 backport 96510a37; the code change is verbatim and the regression test is added to test_xml_etree.py unchanged.