onyx --cves cve-2026-15308
CVE-2026-15308
- score
- 0.1
- cvss
- 7.5
- epss
- 0.6%
- published
- 2026-07-09
- kev added
- —
- first seen
Python html.parser.HTMLParser contains a denial of service caused by repeated unterminated markup declarations in the incremental HTML parser, letting attackers cause CPU exhaustion, exploit requires processing uncontrolled data.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
CWE-400
NVD-CWE-noinfo
References 11
- https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
- https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
- https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
- https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
- https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
- http://www.openwall.com/lists/oss-security/2026/07/09/4
- https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
- https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00
- https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
- https://github.com/python/cpython/issues/153030
- https://github.com/python/cpython/pull/153031