Vulnerability-Lookup

CVE-2026-15308 (GCVE-0-2026-15308)

Vulnerability from cvelistv5 – Published: 2026-07-09 17:10 – Updated: 2026-08-13 00:28

Title

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Summary

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 17:31 UTC

CWE

CWE-400

Assigner

PSF mitre root

References

11 references

URL	Tags
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/pull/153031	patch
https://github.com/python/cpython/issues/153030	issue-tracking
https://github.com/python/cpython/commit/07efb081…	patch
https://github.com/python/cpython/commit/7933f4bf…	patch
https://github.com/python/cpython/commit/bcf98ddb…	patch
https://github.com/python/cpython/commit/e9f92ac0…	patch
https://github.com/python/cpython/commit/785df8f7…	patch
https://github.com/python/cpython/commit/1e7956f1…	patch
https://github.com/python/cpython/commit/c2390b93…	patch
http://www.openwall.com/lists/oss-security/2026/07/09/4

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.15 (python) Affected: 3.14.0 , < 3.14.7 (python) Affected: 3.15.0a1 , < 3.15.0b4 (python)

Credits

Edward-x (https://github.com/YLChen-007) Serhiy Storchaka (https://github.com/serhiy-storchaka) Gregory P. Smith (https://github.com/gpshead) Seth Larson (https://github.com/sethmlarson)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T17:31:19.781935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T17:31:27.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T19:32:36.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/09/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "html.parser",
            "html"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.15",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.7",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b4",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Edward-x (https://github.com/YLChen-007)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka (https://github.com/serhiy-storchaka)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Gregory P. Smith (https://github.com/gpshead)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
            }
          ],
          "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:28:26.690Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/153031"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/153030"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-15308",
    "datePublished": "2026-07-09T17:10:57.317Z",
    "dateReserved": "2026-07-09T17:04:11.926Z",
    "dateUpdated": "2026-08-13T00:28:26.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-15308",
      "date": "2026-10-03",
      "epss": "0.00637",
      "percentile": "0.48708"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-02T16:54:17Z",
      "cve": "CVE-2026-15308",
      "id": "CVE-2026-15308",
      "initial_release_date": "2026-07-11T03:28:42Z",
      "product_status:known_affected": "766",
      "product_status:recommended": "568",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-15308",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-15308.json",
      "version": "30"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-07-09T19:32:36.790Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/07/09/4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15308",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T17:31:19.781935Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T17:31:23.665Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "html.parser",
                "html"
              ],
              "product": "CPython",
              "repo": "https://github.com/python/cpython",
              "vendor": "Python Software Foundation",
              "versions": [
                {
                  "lessThan": "3.10.21",
                  "status": "affected",
                  "version": "0",
                  "versionType": "python"
                },
                {
                  "lessThan": "3.11.16",
                  "status": "affected",
                  "version": "3.11.0",
                  "versionType": "python"
                },
                {
                  "lessThan": "3.12.14",
                  "status": "affected",
                  "version": "3.12.0",
                  "versionType": "python"
                },
                {
                  "lessThan": "3.13.15",
                  "status": "affected",
                  "version": "3.13.0",
                  "versionType": "python"
                },
                {
                  "lessThan": "3.14.7",
                  "status": "affected",
                  "version": "3.14.0",
                  "versionType": "python"
                },
                {
                  "lessThan": "3.15.0b4",
                  "status": "affected",
                  "version": "3.15.0a1",
                  "versionType": "python"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Edward-x (https://github.com/YLChen-007)"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Serhiy Storchaka (https://github.com/serhiy-storchaka)"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Gregory P. Smith (https://github.com/gpshead)"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Seth Larson (https://github.com/sethmlarson)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
                }
              ],
              "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T00:28:26.690Z",
            "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
            "shortName": "PSF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/pull/153031"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/python/cpython/issues/153030"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "assignerShortName": "PSF",
        "cveId": "CVE-2026-15308",
        "datePublished": "2026-07-09T17:10:57.317Z",
        "dateReserved": "2026-07-09T17:04:11.926Z",
        "dateUpdated": "2026-08-13T00:28:26.690Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2026:39183

Vulnerability from osv_almalinux – Published: 2026-07-14 00:00 – Updated: 2026-07-15 08:44 – Source website

Summary

Important: python3.12 security update

Details

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:39183	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/10/ALSA-2026-39183.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python-unversioned-command"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-2.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:39183",
  "modified": "2026-07-15T08:44:08Z",
  "published": "2026-07-14T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:39183"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-39183.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.12 security update"
}

ALSA-2026:39320

Vulnerability from osv_almalinux – Published: 2026-07-14 00:00 – Updated: 2026-07-15 08:46 – Source website

Summary

Important: python3 security update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:39320	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/8/ALSA-2026-39320.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "platform-python"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "platform-python-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "platform-python-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8-77.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:39320",
  "modified": "2026-07-15T08:46:11Z",
  "published": "2026-07-14T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:39320"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-39320.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3 security update"
}

ALSA-2026:39771

Vulnerability from osv_almalinux – Published: 2026-07-15 00:00 – Updated: 2026-07-15 12:27 – Source website

Summary

Important: python3.12 security update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:39771	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/9/ALSA-2026-39771.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:39771",
  "modified": "2026-07-15T12:27:15Z",
  "published": "2026-07-15T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:39771"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-39771.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.12 security update"
}

ALSA-2026:39798

Vulnerability from osv_almalinux – Published: 2026-07-15 00:00 – Updated: 2026-07-15 12:41 – Source website

Summary

Important: python3.9 security, bug fix, and enhancement update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

Bug Fix(es) and Enhancement(s):

python3.9 test_ssl fails ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192) [almalinux-9.8.z] (JIRA:AlmaLinux-194207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:39798	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/9/ALSA-2026-39798.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python-unversioned-command"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.25-7.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * python3.9 test_ssl fails ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192) [almalinux-9.8.z] (JIRA:AlmaLinux-194207)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:39798",
  "modified": "2026-07-15T12:41:39Z",
  "published": "2026-07-15T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:39798"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-39798.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.9 security, bug fix, and enhancement update"
}

ALSA-2026:39893

Vulnerability from osv_almalinux – Published: 2026-07-15 00:00 – Updated: 2026-07-16 09:03 – Source website

Summary

Important: python3.12 security update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:39893	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/8/ALSA-2026-39893.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-rpm-macros"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3.12-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.13-3.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:39893",
  "modified": "2026-07-16T09:03:57Z",
  "published": "2026-07-15T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:39893"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-39893.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.12 security update"
}

ALSA-2026:40856

Vulnerability from osv_almalinux – Published: 2026-07-16 00:00 – Updated: 2026-07-17 07:54 – Source website

Summary

Important: python3.14 security update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:40856	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/10/ALSA-2026-40856.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:40856",
  "modified": "2026-07-17T07:54:44Z",
  "published": "2026-07-16T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:40856"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-40856.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.14 security update"
}

ALSA-2026:41949

Vulnerability from osv_almalinux – Published: 2026-07-20 00:00 – Updated: 2026-07-21 10:15 – Source website

Summary

Important: python3.14 security update

Details

Security Fix(es):

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:41949	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-15308	REPORT
	https://bugzilla.redhat.com/2498608	REPORT
	https://errata.almalinux.org/9/ALSA-2026-41949.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:41949",
  "modified": "2026-07-21T10:15:56Z",
  "published": "2026-07-20T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:41949"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2498608"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-41949.html"
    }
  ],
  "related": [
    "CVE-2026-15308"
  ],
  "summary": "Important: python3.14 security update"
}

BELL-CVE-2026-15308 (CVE-2026-15308)

Vulnerability from osv_bellsoft – Published: 2026-07-10 06:02 – Updated: 2026-07-14 06:00 – Source website

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

https://docs.bell-sw.com/security/cves/CVE-2026-15308

ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "python3",
        "purl": "pkg:apk/alpaquita/python3?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.3-r0"
            },
            {
              "fixed": "3.11.15-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "python3",
        "purl": "pkg:apk/alpaquita/python3?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.10-r1"
            },
            {
              "fixed": "3.12.13-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "python3",
        "purl": "pkg:apk/alpaquita/python3?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.14.5-r4"
            },
            {
              "fixed": "3.14.5-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:23",
        "name": "python3",
        "purl": "pkg:apk/bellsoft-hardened-containers/python3?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.3-r0"
            },
            {
              "fixed": "3.11.15-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:25",
        "name": "python3",
        "purl": "pkg:apk/bellsoft-hardened-containers/python3?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.10-r1"
            },
            {
              "fixed": "3.12.13-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:stream",
        "name": "python3",
        "purl": "pkg:apk/bellsoft-hardened-containers/python3?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.14.5-r4"
            },
            {
              "fixed": "3.14.5-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "id": "BELL-CVE-2026-15308",
  "modified": "2026-07-14T06:00:45.886688Z",
  "published": "2026-07-10T06:02:41.878229Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-15308"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-15308"
  ]
}

bit-libpython-2026-15308

Vulnerability from bitnami_vulndb

Published

2026-08-19 11:37

Modified

2026-09-08 08:34

Summary

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Details

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "libpython",
        "purl": "pkg:bitnami/libpython"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.21"
            },
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.16"
            },
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.14"
            },
            {
              "introduced": "3.13.0"
            },
            {
              "fixed": "3.13.15"
            },
            {
              "introduced": "3.14.0"
            },
            {
              "fixed": "3.14.7"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-15308"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data.",
  "id": "BIT-libpython-2026-15308",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-08-19T11:37:41.302Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/09/4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/issues/153030"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/pull/153031"
    },
    {
      "type": "DISCUSSION",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations"
}

bit-python-2026-15308

Vulnerability from bitnami_vulndb

Published

2026-08-19 11:42

Modified

2026-09-08 08:34

Summary

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Details

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "python",
        "purl": "pkg:bitnami/python"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.21"
            },
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.16"
            },
            {
              "introduced": "3.12.0"
            },
            {
              "fixed": "3.12.14"
            },
            {
              "introduced": "3.13.0"
            },
            {
              "fixed": "3.13.15"
            },
            {
              "introduced": "3.14.0"
            },
            {
              "fixed": "3.14.7"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-15308"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data.",
  "id": "BIT-python-2026-15308",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-08-19T11:42:45.470Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/09/4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/issues/153030"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/pull/153031"
    },
    {
      "type": "DISCUSSION",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-15308 (GCVE-0-2026-15308)

BELL-CVE-2026-15308 (CVE-2026-15308)

Vulnerability from bitnami_vulndb

Vulnerability from bitnami_vulndb

Tags

Sightings

Nomenclature

Related by attack behaviour