Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
A vulnerability (CVE-2026-6879) was found in Python's xml.etree.ElementPath component used in Red Hat Hardened Images RPMs. The flaw causes a denial of service (DoS) due to quadratic time complexity when processing certain XPath index predicates in XML documents, leading to resource exhaustion. This can make the system unresponsive when handling specially crafted XML input. Red Hat has released updated python3.13 packages to address this issue.
AI Analysis
Technical Summary
CVE-2026-6879 is a denial of service vulnerability in Python's xml.etree.ElementPath component, specifically affecting functions like Element.findall() and Element.iterfind() when processing certain XPath index predicates. The vulnerability causes processing time to increase quadratically with input size, resulting in resource exhaustion and potential system unavailability. Red Hat Hardened Images RPMs including python3.13 packages were updated to version 3.13.14-1.7.hum1 to fix this issue. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
An attacker can cause a denial of service by providing specially crafted XML documents that exploit the quadratic time complexity in XPath processing, leading to high CPU and memory consumption and making the system unresponsive. The impact is limited to availability with no confidentiality or integrity effects reported.
Mitigation Recommendations
Red Hat has released updated python3.13 packages (version 3.13.14-1.7.hum1) that fix this vulnerability. Users should apply these updates to mitigate the risk. No alternative mitigations or workarounds are specified in the advisory.
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Description
A vulnerability (CVE-2026-6879) was found in Python's xml.etree.ElementPath component used in Red Hat Hardened Images RPMs. The flaw causes a denial of service (DoS) due to quadratic time complexity when processing certain XPath index predicates in XML documents, leading to resource exhaustion. This can make the system unresponsive when handling specially crafted XML input. Red Hat has released updated python3.13 packages to address this issue.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6879 is a denial of service vulnerability in Python's xml.etree.ElementPath component, specifically affecting functions like Element.findall() and Element.iterfind() when processing certain XPath index predicates. The vulnerability causes processing time to increase quadratically with input size, resulting in resource exhaustion and potential system unavailability. Red Hat Hardened Images RPMs including python3.13 packages were updated to version 3.13.14-1.7.hum1 to fix this issue. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
An attacker can cause a denial of service by providing specially crafted XML documents that exploit the quadratic time complexity in XPath processing, leading to high CPU and memory consumption and making the system unresponsive. The impact is limited to availability with no confidentiality or integrity effects reported.
Mitigation Recommendations
Red Hat has released updated python3.13 packages (version 3.13.14-1.7.hum1) that fix this vulnerability. Users should apply these updates to mitigate the risk. No alternative mitigations or workarounds are specified in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:48278
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a7891c4bf8831d539c859d5
Added to database: 08/09/2026, 14:42:12 UTC
Last enriched: 08/09/2026, 14:43:53 UTC
Last updated: 08/10/2026, 00:41:18 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.