← Vulnerability feed

Vulnerability record · CVE-2026-15308 · published 9 July 2026

CVE-2026-15308: Python uncontrolled resource consumption vulnerability

Python · Python

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

8.7 CVSS 4.0 High EPSS 0.64% · top 51.6% CWE-400 · Uncontrolled resource consumption
8.7CVSS 4.0 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
11References
20 Aug 2026Last modified by NVD

Description

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 Patch
https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7 Patch
https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14 Patch
https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced Patch
https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 Patch
https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00 Patch
https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd Patch
https://github.com/python/cpython/issues/153030 Patch
https://github.com/python/cpython/pull/153031 Issue TrackingPatch
https://mail.python.org/archives/list/[email protected]/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/ Mailing List
http://www.openwall.com/lists/oss-security/2026/07/09/4 Third Party Advisory

Track CVE-2026-15308 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5031Python vulnerabilityMultiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer va…EPSS 3.0%9.8CVE-2022-48565Python xml external entity (xxe) vulnerabilityAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil…EPSS 5.1%9.8CVE-2022-37454Extended keccak code package project extended keccak code package integer overflow vulnerabilityThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute …EPSS 5.8%9.8CVE-2021-29921Python vulnerabilityIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all…EPSS 6.9%9.8CVE-2021-3177Python classic buffer overflow vulnerabilityPython 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic…EPSS 23%9.8CVE-2020-27619Python vulnerabilityIn Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.EPSS 8.3%9.8CVE-2020-15801Python untrusted search path vulnerabilityIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu…EPSS 3.5%9.8CVE-2014-4650Python path traversal vulnerabilityThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo…EPSS 25%

Source: NIST National Vulnerability Database (record CVE-2026-15308), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.