Vulnerability · Published Jul 9, 2026 · Assigned by PSF
CVE-2026-15308Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
High 8.7
In plain English
A high-severity uncontrolled resource consumption in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:10 | python-unversioned-command | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3 | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:9 | python3 | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-debug | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:9 | python3-debug | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-devel | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:9 | python3-devel | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-idle | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:8 | python3-idle | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:9 | python3-idle | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-libs | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:8 | python3-libs | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:9 | python3-libs | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-test | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:8 | python3-test | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:9 | python3-test | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:10 | python3-tkinter | 3.12.13-2.el10_2.1 | ALSA-2026:39183 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-77.el8_10.alma.1 | ALSA-2026:39320 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-7.el9_8.2 | ALSA-2026:39798 |
| AlmaLinux:8 | python3.12 | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12 | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-debug | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-debug | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-devel | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-devel | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-idle | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-idle | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-libs | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-libs | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:8 | python3.12-test | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-test | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.13-3.el8_10 | ALSA-2026:39893 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.13-3.el9_8.1 | ALSA-2026:39771 |
| AlmaLinux:10 | python3.14 | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14 | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-debug | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-debug | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-devel | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-devel | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-debug | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-debug | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-devel | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-devel | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-idle | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-idle | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-libs | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-libs | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-test | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-test | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-freethreading-tkinter | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-freethreading-tkinter | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-idle | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-idle | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-libs | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-libs | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-test | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-test | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| AlmaLinux:10 | python3.14-tkinter | 3.14.5-1.el10_2.1 | ALSA-2026:40856 |
| AlmaLinux:9 | python3.14-tkinter | 3.14.5-1.el9_8.1 | ALSA-2026:41949 |
| Alpine:v3.21 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-15308 |
| Alpine:v3.22 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-15308 |
| Alpine:v3.23 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-15308 |
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2026-15308 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-15308 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2026-15308 |
| Debian:14 | python3.14 | 3.14.7-1 | DEBIAN-CVE-2026-15308 |
| Rocky Linux:8 | python3 | 0:3.6.8-77.el8_10.rocky.0 | RLSA-2026:39320 |
| Rocky Linux:10 | python3.12 | 0:3.12.13-2.el10_2.1 | RLSA-2026:39183 |
| Rocky Linux:8 | python3.12 | 0:3.12.13-3.el8_10 | RLSA-2026:39893 |
| Rocky Linux:9 | python3.12 | 0:3.12.13-3.el9_8.1 | RLSA-2026:39771 |
| Rocky Linux:10 | python3.14 | 0:3.14.5-1.el10_2.1 | RLSA-2026:40856 |
| Rocky Linux:9 | python3.14 | 0:3.14.5-1.el9_8.1 | RLSA-2026:41949 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-7.el9_8.2 | RLSA-2026:39798 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.18 | UBUNTU-CVE-2026-15308 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.18 | USN-8744-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.17 | USN-8744-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.17 | UBUNTU-CVE-2026-15308 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.2 | UBUNTU-CVE-2026-15308 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.2 | USN-8744-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.153.14.0 – before 3.14.73.15.0a1 – before 3.15.0b4 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/ vendor-advisory
- https://github.com/python/cpython/pull/153031 patch
- https://github.com/python/cpython/issues/153030 issue-tracking
- https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 patch
- https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced patch
- https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 patch
- https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd patch
- https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14 patch
- https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7 patch
- https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00 patch
- http://www.openwall.com/lists/oss-security/2026/07/09/4