CVE-2026-15308
High
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
SeverityHigh
CVSS8.7
Exploit probability51. percentile0.6%
Product
Python
PublishedJul 9, 2026
First seenJul 9, 2026
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- python python3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7 or later
Patches
- github.com/python/cpython/pull/153031
- github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
- github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
- github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
- github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
- github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
- github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
- github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python python | v < 3.10.21, 3.11.0 ≤ v < 3.11.16, 3.12.0 ≤ v < 3.12.14, 3.13.0 ≤ v < 3.13.15, 3.14.0 ≤ v < 3.14.7, 3.15.0 | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.