Release date:
2026-07-23 14:42:04 UTC
Description:
* SECURITY UPDATE: quadratic-complexity CPU DoS in incremental HTML parsing
- debian/patches/CVE-2026-15308.patch: port of cpython gh-153030
(GH-153031). HTMLParser.feed() (Lib/HTMLParser.py) previously
concatenated new data onto the unparsed buffer and re-scanned it from
the start on every call, so feeding an unterminated construct in many
small chunks was quadratic. New data is now accumulated in a list and
only joined and parsed once enough has piled up; close() flushes the
pending buffer.
- CVE-2026-15308
Updated packages:
-
alt-python27_2.7.18-25_amd64.deb
sha:d8747d1635d0ab6f8ab508842aadfa0b1da952bd
-
alt-python27-debug_2.7.18-25_amd64.deb
sha:54a2812ef32e96310318b467238761b6bb7c2942
-
alt-python27-devel_2.7.18-25_amd64.deb
sha:09dc19aa729bbc60d258ad6d97222d116ed894c4
-
alt-python27-idle_2.7.18-25_amd64.deb
sha:c8491574313e401873f31bbdf21c448486103bef
-
alt-python27-libs_2.7.18-25_amd64.deb
sha:2d3ad9ef94443e08a37aaface5b5cb33c22fe7f0
-
alt-python27-test_2.7.18-25_amd64.deb
sha:6fdd2ab5d62fe6b9398d18bc6e217e60b35ef5a2
-
alt-python27-tkinter_2.7.18-25_amd64.deb
sha:6fde6caa3c70d8fac32848d9f6559d11623da708
-
alt-python27-tools_2.7.18-25_amd64.deb
sha:5300fa68abddea1ae9fb2c2d93ba39f3ef83cb16
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
