8.7

CVE-2026-15308: Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Analyzed
AliasesALPINE-CVE-2026-15308RHSA-2026:37533RHSA-2026:37535
Published 09-07-2026Last modified 13-08-2026

Vulnerability summary

CVE-2026-15308 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in python software foundation cpython. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.5% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.64%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 38 · Related 32
OPENSUSE-SU-2026:11426-1OPENSUSE-SU-2026:11427-1OPENSUSE-SU-2026:11428-1OPENSUSE-SU-2026:11429-1OPENSUSE-SU-2026:11534-1OPENSUSE-SU-2026:11597-1

Timeline

  1. 09-07-2026
    PublishedVulnerability first disclosed.
  2. 13-08-2026
    Last modifiedVulnerability information updated.

Description

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVSS metrics

10 scores · 8 sources · 2 versions

EPSS trend

Probability

0.64%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat51 products
  • platform-python< 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
  • platform-python-debug< 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
  • platform-python-devel< 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
  • python-unversioned-command< 0:3.12.13-2.el10_2.1 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10
  • python3< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
Ubuntu11 products
  • python2.7< 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-13ubuntu1.5+esm9
  • python3.10< 3.10.12-1~22.04.18
  • python3.11< 3.11.0~rc1-1~22.04.1+esm2
  • python3.12< 3.12.3-1ubuntu0.17
  • python3.14< 3.14.4-1ubuntu0.2
Chainguard5 products
  • python-3.10< 3.10.21-r0
  • python-3.11< 3.11.16-r1
  • python-3.12< 3.12.14-r2
  • python-3.13< 3.13.14-r3
  • python-3.14< 3.14.6-r4
Wolfi5 products
  • python-3.10< 3.10.21-r0
  • python-3.11< 3.11.16-r1
  • python-3.12< 3.12.14-r2
  • python-3.13< 3.13.14-r3
  • python-3.14< 3.14.6-r4
Debian3 products
  • python3.11< 3.11.2-6+deb12u9
  • python3.13< 3.13.15-1 | All versions (No fix recorded)
  • python3.14< 3.14.7-1
Alpine1 product
  • python3< 3.12.14-r0 | < 3.14.7-r0
Python1 product
  • python< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7 | 3.15.0:alpha8 | 3.15.0:beta1 | 3.15.0:beta2 | 3.15.0:beta3
Python software foundation1 product
  • cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0b4

8 vendors · 78 products

References

55 links
Show all 55 references