Most recent entries from all

ALSA-2026:39183 — Important: python3.12 security update

Affected: AlmaLinux:10: python-unversioned-command, AlmaLinux:10: python3, AlmaLinux:10: python3-debug, AlmaLinux:10: python3-devel, AlmaLinux:10: python3-idle, AlmaLinux:10: python3-libs, AlmaLinux:10: python3-test, AlmaLinux:10: python3-tkinter

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-15308

Affected: Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3

BIT-libpython-2026-15308 — Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Affected: Bitnami: libpython

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

certfr-2026-avi-0858 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2026-avi-0858

EUVD-2026-351832

fkie_cve-2026-15308

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

GHSA-7qj2-q5c8-cxx5

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

msrc_CVE-2026-15308 — Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

msrc_CVE-2026-15308

OESA-2026-3180 — python3 security update

Affected: openEuler:24.03-LTS-SP1: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

openSUSE-SU-2026:11426-1 — python310-3.10.20-8.1 on GA media

python310-3.10.20-8.1 on GA media

RHSA-2026:37533 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

RLSA-2026:39183 — Important: python3.12 security update

Affected: Rocky Linux:10: python3.12

Security Fix(es):

* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23159-1 — Security update for python313

Security update for python313

UBUNTU-CVE-2026-15308

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 6 more

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

WID-SEC-W-2026-2272 — CPython: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CPython ausnutzen, um einen Denial of Service Angriff durchzuführen.