This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-15308 →

DEBIAN-CVE-2026-15308

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processin...

Original description

The description as published by the source.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python3.11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-6+deb12u9"}]}]

Debian:13 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.15-1"}]}]

Debian:14 python3.14

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]

References

advisory security-tracker.debian.org