Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6879: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. CVE-2026-18503: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.12 | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-debug | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-debuginfo | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-debugsource | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-devel | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-idle | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-libs | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-test | 0:3.12.14-2.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.12-tkinter | 0:3.12.14-2.amzn2023.0.1 |
Vulnerabilities 2
-
Low 2.4
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
-
Low 2.0
Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the firs…