Release date:
2026-07-22 12:48:08 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser was vulnerable to a
quadratic-complexity CPU denial of service. Feeding an unterminated
markup construct (e.g. a tag or comment) in many small chunks made
feed() re-scan and re-concatenate the growing unparsed buffer on
every call, which is quadratic in the input size.
- debian/patches/CVE-2026-15308.patch: backport of cpython
bcf98ddb (gh-153030). Accumulates incoming data in a list and
only joins/parses it once enough has piled up, flushing any
pending data in close().
- CVE-2026-15308
Updated packages:
-
alt-python37_3.7.17-26_amd64.deb
sha:c2c87a91dcb58dbac3bfd8693eda54b3e62a10c6
-
alt-python37-debug_3.7.17-26_amd64.deb
sha:69c2e1898f5fb3e8f6ba493228dfff47bf578419
-
alt-python37-devel_3.7.17-26_amd64.deb
sha:22b907401153e016f91b7eb38ae3b7235f6b1fd2
-
alt-python37-libs_3.7.17-26_amd64.deb
sha:9e0cca0baffc055924994b9cf5ba2a88fde471dd
-
alt-python37-test_3.7.17-26_amd64.deb
sha:82f933dbd45ffc69ccd5a9302a913f2d3fbc18ab
-
alt-python37-tkinter_3.7.17-26_amd64.deb
sha:307ae4822ef5d65b5de70f3e847290ce58544ad0
-
alt-python37-tools_3.7.17-26_amd64.deb
sha:e0573e27b4bd2a1b86370fa63a605cd30feca1ab
-
alt-python37_3.7.17-26_arm64.deb
sha:59179992a21849a37ecd03e69ec17d73c5ab5882
-
alt-python37-debug_3.7.17-26_arm64.deb
sha:4b9241171ced919b206f33e07787f895dacf7bdd
-
alt-python37-devel_3.7.17-26_arm64.deb
sha:d93221db4a5fa67ba25ff544c70c258bdd44b07c
-
alt-python37-libs_3.7.17-26_arm64.deb
sha:2e7878f1f033d041b8f0e0892b136fd2beb79475
-
alt-python37-test_3.7.17-26_arm64.deb
sha:0f9a1632d9c9ea4f49fa533cf799a43f6422b6b2
-
alt-python37-tkinter_3.7.17-26_arm64.deb
sha:ffa0bef67befdee30aa20c52950a060f03818671
-
alt-python37-tools_3.7.17-26_arm64.deb
sha:5c820c7e86974b064b9e4f25a9a0d69ac568777b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
