The vulnerability in CPython's XML ElementTree module causes Element.findall() and fully-consumed Element.iterfind() to have O(n^2) time complexity when XPath index predicates are used on XML documents containing many siblings with the same tag name. Element.find() is impacted only if the first matching element is near the end of the sibling list, such as with predicates like [last()] or [last()-N]. This inefficiency can degrade performance significantly when processing large XML documents with these query patterns.

The impact is limited to degraded performance due to inefficient XML querying, which could lead to increased CPU usage and slower application response times when processing large XML documents with specific XPath predicates. There is no indication of a security breach, data corruption, or unauthorized access. The CVSS score of 2 and low severity rating reflect this limited impact.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should consider avoiding XPath index predicates on large XML documents or limit the size of sibling elements when using Element.findall() or Element.iterfind().