Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6879: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. CVE-2026-18503: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.14 | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-debug | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-debuginfo | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-debugsource | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-devel | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-debug | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-devel | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-idle | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-libs | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-test | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-freethreading-tkinter | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-idle | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-libs | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-test | 0:3.14.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.14-tkinter | 0:3.14.7-1.amzn2023.0.1 |
Vulnerabilities 2
-
Low 2.4
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
-
Low 2.0
Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the firs…