- CVE-2026-15308: html.parser.HTMLParser had quadratic complexity when an unterminated construct (tag, comment, declaration) was fed across many feed() calls, since each call rescanned the growing buffer and reconcatenated onto it, allowing a CPU denial-of-service on uncontrolled data. feed() now accumulates new data in a list and only joins and parses it once enough has piled up, flushing the buffer in close() (upstream gh-153030 / bcf98ddb, adapted to 3.6: identical feed()/close()/reset() logic, test added with "from test import support", NEWS.d fragment omitted).