Most recent entries from all

ALSA-2026:39183 — Important: python3.12 security update

2026-10-03T17:23:40.967686+00:00

Affected: AlmaLinux:10: python-unversioned-command, AlmaLinux:10: python3, AlmaLinux:10: python3-debug, AlmaLinux:10: python3-devel, AlmaLinux:10: python3-idle, AlmaLinux:10: python3-libs, AlmaLinux:10: python3-test, AlmaLinux:10: python3-tkinter

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-15308

2026-10-03T17:23:40.967800+00:00

Affected: Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3

BIT-libpython-2026-15308 — Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

2026-10-03T17:23:40.967830+00:00

Affected: Bitnami: libpython

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

certfr-2026-avi-0858 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un déni de service à distance.

2026-10-03T17:23:40.967852+00:00

certfr-2026-avi-0858

EUVD-2026-351832

2026-10-03T17:23:40.967868+00:00

EUVD-2026-351832

fkie_cve-2026-15308

2026-10-03T17:23:40.967879+00:00

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

GHSA-7qj2-q5c8-cxx5

2026-10-03T17:23:40.967899+00:00

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

msrc_CVE-2026-15308 — Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

2026-10-03T17:23:40.967913+00:00

msrc_CVE-2026-15308

OESA-2026-3180 — python3 security update

2026-10-03T17:23:40.967930+00:00

Affected: openEuler:24.03-LTS-SP1: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

openSUSE-SU-2026:11426-1 — python310-3.10.20-8.1 on GA media

2026-10-03T17:23:40.967960+00:00

python310-3.10.20-8.1 on GA media

RHSA-2026:37533 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

2026-10-03T17:23:40.967980+00:00

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

RLSA-2026:39183 — Important: python3.12 security update

2026-10-03T17:23:40.967996+00:00

Affected: Rocky Linux:10: python3.12

Security Fix(es):

* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23159-1 — Security update for python313

2026-10-03T17:23:40.968019+00:00

Security update for python313

UBUNTU-CVE-2026-15308

2026-10-03T17:23:40.968038+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 6 more

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

WID-SEC-W-2026-2272 — CPython: Schwachstelle ermöglicht Denial of Service

2026-10-03T17:23:40.968078+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CPython ausnutzen, um einen Denial of Service Angriff durchzuführen.