🟠 High | Source: Microsoft Security Response Center
CVE-2026-6879 describes a quadratic time complexity flaw in Python’s xml.etree.ElementPath when processing index predicates in XPath expressions. An attacker able to supply crafted XML input could trigger excessive CPU consumption, leading to a denial-of-service condition. This is relevant to Azure services and workloads that parse XML using Python’s standard library.
Security Architect’s Take: Audit any Azure-hosted applications or functions that accept untrusted XML input and process it via Python’s xml.etree ElementPath — apply vendor patches promptly and consider input size and complexity limits as a defence-in-depth measure.
Original advisory: CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates