Release date:
2026-07-22 08:55:02 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be
driven into quadratic-time CPU consumption. Each feed() concatenated new
data onto the unparsed buffer and re-scanned it from the start, so feeding
a long unterminated construct (tag, comment, declaration, PI, CDATA) in
many small chunks was quadratic in the input size — a denial of service
(CWE-407).
- debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4
(gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71).
feed() now accumulates incoming data in a list and only joins and
parses it once the buffer has doubled, and close() flushes any pending
data before the final scan.
- CVE-2026-15308
Updated packages:
-
alt-python39_3.9.23-22_amd64.deb
sha:a682ecd1fd5223ca6824dde2814d58ff05a56a00
-
alt-python39-debug_3.9.23-22_amd64.deb
sha:cca40a46f799424faeef81819a62b07c8c2cfadb
-
alt-python39-devel_3.9.23-22_amd64.deb
sha:9a54c039c972a0225b96b911ca849baf2d8c3540
-
alt-python39-idle_3.9.23-22_amd64.deb
sha:4b17146a26024d9ab30c191046b14493e487b890
-
alt-python39-libs_3.9.23-22_amd64.deb
sha:1970c84b4bc3025d527f4272619f6f8667336fbc
-
alt-python39-test_3.9.23-22_amd64.deb
sha:f06bde523b34eb8efef90d6f5b1b7cb571b52397
-
alt-python39-tkinter_3.9.23-22_amd64.deb
sha:d3c5864e69450f430b65063c1eb87f8b0b5d7518
-
alt-python39_3.9.23-22_arm64.deb
sha:ad728ee82ae0c660b971c7828f14faf8eea11d2b
-
alt-python39-debug_3.9.23-22_arm64.deb
sha:c35da49605ac7c84a6fb18fa0aff9ffa6f0d34a0
-
alt-python39-devel_3.9.23-22_arm64.deb
sha:b1e7e037374c498fd891cba78f0d1e0cd795fdd0
-
alt-python39-idle_3.9.23-22_arm64.deb
sha:5d7d75af796f481b62f6fde17112d7bdf354fbf6
-
alt-python39-libs_3.9.23-22_arm64.deb
sha:86a9aa7b6ed4cf1f1f83ad1e1fb34eb4ca240d83
-
alt-python39-test_3.9.23-22_arm64.deb
sha:f3e1f6ff7ccfd68b232fb8f7c05c5b59d8cb470f
-
alt-python39-tkinter_3.9.23-22_arm64.deb
sha:a1c12735ee4a18209fa6ac277e57997648765c69
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
