Release date:
2026-07-23 10:55:30 UTC
Description:
* SECURITY UPDATE: quadratic-complexity CPU DoS in incremental HTML parsing
- debian/patches/CVE-2026-15308.patch: port of cpython gh-153030
(GH-153031). HTMLParser.feed() (Lib/HTMLParser.py) previously
concatenated new data onto the unparsed buffer and re-scanned it from
the start on every call, so feeding an unterminated construct in many
small chunks was quadratic. New data is now accumulated in a list and
only joined and parsed once enough has piled up; close() flushes the
pending buffer.
- CVE-2026-15308
Updated packages:
-
alt-python27_2.7.18-25_amd64.deb
sha:5e96da6bf5f120489fe823348f05c256b6d650ae
-
alt-python27-debug_2.7.18-25_amd64.deb
sha:2c1b3231671e2dd272e84fa2ea30d996f5492bf4
-
alt-python27-devel_2.7.18-25_amd64.deb
sha:6e7439a69fe23bdd3baba37e0aaf1b4ca1c00dd2
-
alt-python27-idle_2.7.18-25_amd64.deb
sha:13fb7d79ead951ce40a3c54c000502e208061128
-
alt-python27-libs_2.7.18-25_amd64.deb
sha:ef47f29b73832345b7bfaea2a39367d54f1eead2
-
alt-python27-test_2.7.18-25_amd64.deb
sha:a6479b223fe05d409a1230197733fd812c346415
-
alt-python27-tkinter_2.7.18-25_amd64.deb
sha:f9422613d9cb3476eb0049af1267b7a7036f8b9b
-
alt-python27-tools_2.7.18-25_amd64.deb
sha:0aa118c9fb797b04d9e85cfc1eb1048be694a74c
-
alt-python27_2.7.18-25_arm64.deb
sha:d0a36f9a20dab3c62ecb4cbfcbe6146c2688afa0
-
alt-python27-debug_2.7.18-25_arm64.deb
sha:6a4b25865485648519d4e889a5ec58b0056d9b05
-
alt-python27-devel_2.7.18-25_arm64.deb
sha:fe1f2f5046f5c39dee9b50ba084a776e5fc0d018
-
alt-python27-idle_2.7.18-25_arm64.deb
sha:77147e0bf3f059cfc4052dec6d279bb06cc30c26
-
alt-python27-libs_2.7.18-25_arm64.deb
sha:f3037a67a46255ef7616057a10ebcd3ceb4ebd9e
-
alt-python27-test_2.7.18-25_arm64.deb
sha:b68c061fc7aa306c00baeac98ae0a164764424ee
-
alt-python27-tkinter_2.7.18-25_arm64.deb
sha:b6c8f72dff62872e40dd633d98e19c298f8d107b
-
alt-python27-tools_2.7.18-25_arm64.deb
sha:60e0a93e854d987b64e14adc711148f7fb4b3e4c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
