CVE-2026-15308

ADVISORY - debian

Summary

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

python3.14
python3.13
python3.11
python3.9
python2.7 https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/ https://github.com/python/cpython/issues/153030 https://github.com/python/cpython/pull/153031 https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd (v3.15.0b4) https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 (3.14 branch) https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced (3.13 branch)

EPSS Score⁠: 0.00551 (0.428)

Common Weakness Enumeration (CWE)

ADVISORY - redhat

CWE-835⁠

Loop with Unreachable Exit Condition ('Infinite Loop')

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.