CVE-2026-15308
Vulnerability Summary
Timeline
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.64%• Percentile: 49%
Techniques & Countermeasures
- CWE-400•Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Affected Systems
- alpine•python3
< 3.12.14-r0 | < 3.12.14-r0 | < 3.12.14-r0 | < 3.14.7-r0
- chainguard•python-3.10
< 3.10.21-r0
- chainguard•python-3.11
< 3.11.16-r1
- chainguard•python-3.12
< 3.12.14-r2
- chainguard•python-3.13
< 3.13.14-r3
- chainguard•python-3.14
< 3.14.6-r4
- wolfi•python-3.10
< 3.10.21-r0
- wolfi•python-3.11
< 3.11.16-r1
- wolfi•python-3.12
< 3.12.14-r2
- wolfi•python-3.13
< 3.13.14-r3
- wolfi•python-3.14
< 3.14.6-r4
- debian•python2.7
all
- debian•python3.11
all
- debian•python3.13
all | all | < 3.13.15-1
- debian•python3.14
all | < 3.14.7-1
- debian•python3.9
all
- ubuntu•python2.7
all | < 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-13ubuntu1.5+esm9
- ubuntu•python3.10
all | < 3.10.12-1~22.04.18
- ubuntu•python3.11
all | all | < 3.11.0~rc1-1~22.04.1+esm2
- ubuntu•python3.12
all | < 3.12.3-1ubuntu0.17
- ubuntu•python3.14
all | < 3.14.4-1ubuntu0.2
- ubuntu•python3.4
all | < 3.4.3-1ubuntu1~14.04.7+esm21
- ubuntu•python3.5
all | < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11 | < 3.5.2-2ubuntu0~16.04.13+esm25
- ubuntu•python3.6
all | < 3.6.9-1~18.04ubuntu1.13+esm10
- ubuntu•python3.7
all | < 3.7.5-2ubuntu1~18.04.2+esm11
- ubuntu•python3.8
all | < 3.8.0-3ubuntu1~18.04.2+esm11 | < 3.8.10-0ubuntu1~20.04.18+esm7
- ubuntu•python3.9
all | < 3.9.5-3ubuntu0~20.04.1+esm11
- python software foundation•cpython
< 3.15.0 | < 3.13.15 | < 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0b4
- python•python
< 3.15.0 | < 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7 | 3.15.0:alpha8 | 3.15.0:beta1 | 3.15.0:beta2 | 3.15.0:beta3
- redhat•platform-python
< 0:3.6.8-77.el8_10 | < 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12 | < 0:3.6.8-39.el8_4.12
- redhat•platform-python-debug
< 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•platform-python-devel
< 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•python-unversioned-command
< 0:3.12.13-2.el10_2.1 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10
- redhat•python3
< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•python3-debug
< 0:3.12.13-2.el10_2.1 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10
- redhat•python3-debuginfo
< 0:3.6.8-77.el8_10 | < 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12 | < 0:3.6.8-39.el8_4.12
- redhat•python3-debugsource
< 0:3.6.8-77.el8_10 | < 0:3.6.8-77.el8_10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12 | < 0:3.6.8-39.el8_4.12
- redhat•python3-devel
< 0:3.12.13-2.el10_2.1 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10
- redhat•python3-idle
< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•python3-libs
< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•python3-test
< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12 | < 0:3.6.8-39.el8_4.12
- redhat•python3-tkinter
< 0:3.12.13-2.el10_2.1 | < 0:3.6.8-77.el8_10 | < 0:3.9.25-7.el9_8.2 | < 0:3.9.25-7.el9_8.2 | < 0:3.12.9-2.el10_0.10 | < 0:3.6.8-51.el8_8.16 | < 0:3.6.8-47.el8_6.14 | < 0:3.6.8-39.el8_4.12
- redhat•python3.12
< 0:3.12.13-2.el10_2.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-2.el10_0.10 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.1-4.el9_4.14
- redhat•python3.12-debug
< 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-1.el9_6.9
- redhat•python3.12-debuginfo
< 0:3.12.13-2.el10_2.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-2.el10_0.10 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.1-4.el9_4.14
- redhat•python3.12-debugsource
< 0:3.12.13-2.el10_2.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-2.el10_0.10 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.1-4.el9_4.14
- redhat•python3.12-devel
< 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.1-4.el9_4.14
- redhat•python3.12-idle
< 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-1.el9_6.9
- redhat•python3.12-libs
< 0:3.12.13-3.el9_8.1 | < 0:3.12.13-3.el8_10 | < 0:3.12.9-1.el9_6.9 | < 0:3.12.1-4.el9_4.14
- redhat•python3.12-rpm-macros
< 0:3.12.13-3.el8_10
Showing first 50 affected entries in server-rendered view.
References (55)
- https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
- https://github.com/python/cpython/pull/153031
- https://github.com/python/cpython/issues/153030
- https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
- https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
- https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
- https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
- http://www.openwall.com/lists/oss-security/2026/07/09/4
- https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
- https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
- https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00
- https://access.redhat.com/errata/RHSA-2026:37533
- https://access.redhat.com/security/cve/CVE-2026-15308
- https://access.redhat.com/security/updates/classification/
- https://images.redhat.com/
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37533.json
- https://bugzilla.redhat.com/show_bug.cgi?id=2498608
- https://www.cve.org/CVERecord?id=CVE-2026-15308
- https://nvd.nist.gov/vuln/detail/CVE-2026-15308
- https://access.redhat.com/errata/RHSA-2026:37535
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37535.json
- https://access.redhat.com/errata/RHSA-2026:39183
- https://access.redhat.com/security/updates/classification/#important
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39183.json
- https://access.redhat.com/errata/RHSA-2026:39320
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39320.json
- https://access.redhat.com/errata/RHSA-2026:39771
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39771.json
- https://access.redhat.com/errata/RHSA-2026:39798
- https://issues.redhat.com/browse/RHEL-194207
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39798.json
- https://access.redhat.com/errata/RHSA-2026:39893
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39893.json
- https://access.redhat.com/errata/RHSA-2026:40856
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40856.json
- https://access.redhat.com/errata/RHSA-2026:41949
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41949.json
- https://access.redhat.com/errata/RHSA-2026:47939
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47939.json
- https://access.redhat.com/errata/RHSA-2026:50064
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50064.json
- https://access.redhat.com/errata/RHSA-2026:50065
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50065.json
- https://access.redhat.com/errata/RHSA-2026:50770
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50770.json
- https://access.redhat.com/errata/RHSA-2026:50771
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50771.json
- https://access.redhat.com/errata/RHSA-2026:50816
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50816.json
- https://ubuntu.com/security/CVE-2026-15308
- https://security-tracker.debian.org/tracker/CVE-2026-15308
- https://security.alpinelinux.org/vuln/CVE-2026-15308
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15308.json
- https://github.com/python/cpython
- https://ubuntu.com/security/notices/USN-8744-1