CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

What is CVE-2026-15308?

CVE-2026-15308 is a high-severity denial of service vulnerability in Python Python, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Weakness: CWE-400

Which versions are affected by CVE-2026-15308?

3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.

Products include Python Python.

How do I fix CVE-2026-15308?

Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.15.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-15308 being exploited?

There is no known exploitation of CVE-2026-15308 in the wild and no public exploit code.

Other vulnerabilities in Python Python

• CVE-2008-5031 Integer overflow in n/a Critical 10.0
• CVE-2014-4650 Path traversal in n/a Critical 9.8
• CVE-2016-5636 Integer overflow in n/a Critical 9.8
• CVE-2007-4559 Path traversal in n/a Critical 9.8
• CVE-2017-17522 Command injection in n/a High 8.8

All Python Python vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-15308, ALSA-2026:39183, ALSA-2026:39320, ALSA-2026:39771, ALSA-2026:39798, ALSA-2026:39893 and 69 more.