Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-09T17:10:57 python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-835

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.

This Important vulnerability in Python's `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 2026-07-14T00:00:00Z RHSA-2026:39183 python3.12-0:3.12.13-2.el10_2.1 Red Hat Enterprise Linux 10 2026-07-16T00:00:00Z RHSA-2026:40856 python3.14-0:3.14.5-1.el10_2.1 Red Hat Enterprise Linux 8 2026-07-14T00:00:00Z RHSA-2026:39320 python3-0:3.6.8-77.el8_10 Red Hat Enterprise Linux 8 2026-07-15T00:00:00Z RHSA-2026:39893 python3.12-0:3.12.13-3.el8_10 Red Hat Enterprise Linux 8 2026-07-14T00:00:00Z RHSA-2026:39320 python3-0:3.6.8-77.el8_10 Red Hat Enterprise Linux 9 2026-07-15T00:00:00Z RHSA-2026:39771 python3.12-0:3.12.13-3.el9_8.1 Red Hat Enterprise Linux 9 2026-07-15T00:00:00Z RHSA-2026:39798 python3.9-0:3.9.25-7.el9_8.2 Red Hat Enterprise Linux 9 2026-07-15T00:00:00Z RHSA-2026:39798 python3.9-0:3.9.25-7.el9_8.2 Red Hat Hardened Images 2026-07-10T00:00:00Z RHSA-2026:37533 python3-14-main-3.14.6-1.3.hum1 Red Hat Hardened Images 2026-07-10T00:00:00Z RHSA-2026:37535 python3-13-main-3.13.14-1.3.hum1 Red Hat Hardened Images 2026-07-10T00:00:00Z RHSA-2026:38017 python3-12-main-3.12.13-3.5.hum1 Red Hat Hardened Images 2026-07-10T00:00:00Z RHSA-2026:38018 python3-11-main-3.11.15-5.2.hum1 Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Enterprise Linux 6 Out of support scope python Red Hat Enterprise Linux 7 Out of support scope python Red Hat Enterprise Linux 7 Out of support scope python3 Red Hat Enterprise Linux 8 Not affected python36:3.6/python36 Red Hat Enterprise Linux 9 Affected python3.14 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/ocp-virt-validation-checkup-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15308 https://nvd.nist.gov/vuln/detail/CVE-2026-15308 https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd https://github.com/python/cpython/issues/153030 https://github.com/python/cpython/pull/153031 https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/