CVE-2026-6879 is a vulnerability in Python's xml.etree.ElementPath component that leads to denial of service through resource exhaustion. Specifically, certain XPath index predicates used with Element.findall() and Element.iterfind() cause processing time to grow quadratically with input size. This can be exploited by a remote attacker providing malicious XML files to cause service disruption. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-407. Red Hat has released updated python3.13 RPM packages for their Hardened Images to address this issue, as detailed in advisory RHSA-2026:48278.

The vulnerability allows a remote attacker to cause a denial of service by supplying specially crafted XML documents that trigger excessive CPU and memory consumption during XML processing. This can make affected systems unresponsive, impacting service availability. There is no impact on confidentiality or integrity. The severity is rated low by Red Hat due to the high attack complexity and requirement for privileges.

Red Hat has released updated python3.13 RPM packages for Red Hat Hardened Images that fix this vulnerability. Users should apply the security update as described in Red Hat Advisory RHSA-2026:48278. No additional mitigations are specified or required beyond applying the official update.