python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

🗓️ 10 Jul 2026 03:37:41Reported by RedHatType

Python's incremental HTML parser can be exploited via repeated incomplete markup declarations to exhaust processing resources.

Reporter	Title	Published	Views	Family All 32
ATTACKERKB	CVE-2026-15308	9 Jul 202617:10	–	attackerkb
Circl	CVE-2026-15308	9 Jul 202617:55	–	circl
CVE	CVE-2026-15308	9 Jul 202617:10	–	cve
Cvelist	CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	9 Jul 202617:10	–	cvelist
EUVD	EUVD-2026-42638	9 Jul 202617:10	–	euvd
NVD	CVE-2026-15308	9 Jul 202617:16	–	nvd
OSV	BELL-CVE-2026-15308	10 Jul 202606:02	–	osv
OSV	BIT-LIBPYTHON-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	12 Jul 202623:46	–	osv
OSV	BIT-PYTHON-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	12 Jul 202623:53	–	osv
OSV	BIT-PYTHON-MIN-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	12 Jul 202623:53	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	any	noarch	python3	14-main@aarch64	[email protected]
Red Hat Enterprise Linux	any	noarch	python3	14-main@x86_64	python3-14-main@x86_64.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-15308
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
github	www.github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
github	www.github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
github	www.github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
github	www.github.com/python/cpython/issues/153030
github	www.github.com/python/cpython/pull/153031
mail	www.mail.python.org/archives/list/[email protected]/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-15308

14 Jul 2026 13:23Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

CVSS 48.7

EPSS0.00553

SSVC