CVE-2026-15308 Python vulnerability

Who is affected

How to fix it

CVE-2026-15308 affects CPython html.parser.HTMLParser when uncontrolled data containing repeated unterminated markup declarations is processed incrementally. The impact is CPU denial of service, so prioritize public services, crawlers, ingestion workers, and APIs that parse user-controlled or remote HTML with html.parser. The CVE record currently identifies pre-3.15.0 CPython versions as affected, while downstream vendors may ship backported fixes before application teams move to a new Python feature release. Apply the vendor-supported patched Python package when available and add input bounds around untrusted HTML parsing until every runtime is remediated.

1. Inventory Python runtimes, containers, serverless images, crawlers, ingestion workers, and applications that use html.parser.HTMLParser or libraries that wrap it.
2. Identify CPython versions and vendor packages affected by CVE-2026-15308, including long-lived base images and embedded Python runtimes.
3. Upgrade to a vendor-supported Python package that includes the CPython fix for CVE-2026-15308, or to a fixed upstream release when available for the deployed branch.
4. Add request-size, parse-time, worker-timeout, and queue-depth limits around untrusted HTML parsing workflows while remediation is pending.
5. Prefer hardened HTML parsing strategies for untrusted data and avoid feeding attacker-controlled incremental fragments directly into HTMLParser without bounds.
6. Review application, worker, and infrastructure metrics for CPU spikes, parser timeouts, repeated unterminated markup input, or denial-of-service patterns.
7. If exploitation is suspected, preserve sample payloads, scale or isolate affected workers, and rotate credentials exposed to degraded services as needed.

Verify the fix

• Confirm runtime package metadata shows a vendor-patched Python build or fixed upstream release for CVE-2026-15308.
• Confirm parser workloads enforce input size, time, and resource limits for uncontrolled HTML.
• Run focused regression tests with repeated unterminated markup declarations and confirm CPU use remains bounded.
• Rerun dependency, container, and host vulnerability scans to confirm vulnerable Python packages are no longer reported where vendor fixes exist.
• Document patched runtime versions, image digests, resource limits, test evidence, and any temporary compensating controls.

Related categories

Trusted references

FAQ