CVE-2026-15308 SNYK-DEBIAN11-PYTHON39-18309153

[github-actions]

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.9 package and not the python3.9 package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data.

Remediation

There is no fixed version for Debian:11 python3.9.

References

• https://security-tracker.debian.org/tracker/CVE-2026-15308
• python/cpython@07efb08
• python/cpython@7933f4b
• python/cpython@bcf98dd
• python/cpython@e9f92ac
• Another worst case quadratic complexity in HTMLParser python/cpython#153030
• gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser python/cpython#153031
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
• http://www.openwall.com/lists/oss-security/2026/07/09/4