Markdown-it: Quadratic-time Denial Of Service In Inline HTML Parsing With Html Enabled

Summary With "html: true", markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments "", "?", "", and "". When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc (CENTOS7:CLSA-2026:1784280875)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1784280875 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1784713418)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1784713418 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_39771)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639771 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS8.4:CLSA-2026:1784798087)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784798087 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (crlsa-2026_39320)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639320 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Rocky Linux 10.2 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_39183)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_41949)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202641949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1786707590)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786707590 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

Rocky Linux 10.2 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_40856)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202640856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1784110083)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784110083 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_39798)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639798 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Bug Fixes and Enhancements: python3.9 testssl fai...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1784110083)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784110083 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations whe...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_39893)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639893 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1784137549)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784137549 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

CentOS Linux 8.5 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS8.5:CLSA-2026:1784798816)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784798816 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1784799167)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784799167 advisory. - The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when...

CVE-2026-93494

CVE-2026-93494 affects Netty's StompSubframeDecoder in the netty-codec-stomp component. A remote attacker can send a specially crafted STOMP frame body missing its terminating null byte , causing the decoder to allocate a ByteBuf that is never released . This results in a permanent memory leak th...