CVE-2026-15308

Name
CVE-2026-15308
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
Patch https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
Patch https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
Patch https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
Patch https://github.com/python/cpython/issues/153030
Issue Tracking https://github.com/python/cpython/pull/153031
Mailing List https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
Third Party Advisory http://www.openwall.com/lists/oss-security/2026/07/09/4
cna@python.org https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
cna@python.org https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
cna@python.org https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= None < 3.15.0
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= None < 3.10.21
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= 3.11.0 < 3.11.16
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= 3.12.0 < 3.12.14
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= 3.13.0 < 3.13.15
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= 3.14.0 < 3.14.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 edge-main 3.14.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.24-main 3.14.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.23-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.22-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.21-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed