CVE-2026-15308

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

• CWE-400

• https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9Patch
• https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7Patch
• https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14Patch
• https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969cedPatch
• https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606Patch
• https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00Patch
• https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bdPatch
• https://github.com/python/cpython/issues/153030Patch
• https://github.com/python/cpython/pull/153031Issue Tracking, Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/Mailing List
• https://www.openwall.com/lists/oss-security/2026/07/09/4Third Party Advisory

Published

Jul 9, 2026

Last Modified

Aug 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15302The ARMember plugin for WordPress is vulnerable to Directory…5.3
• CVE-2026-15303The 6Storage Rentals plugin for WordPress is vulnerable to a…9.8
• CVE-2026-15304The Plugin Organizer plugin for WordPress is vulnerable to S…6.5
• CVE-2026-15305Users were able to upload files with arbitrary MIME types to…6.3
• CVE-2026-15306The Product Feed Manager For WooCommerce – Sell on 200+ Onli…6.1
• CVE-2026-15307An issue was discovered in Django 5.2 before 5.2.17 and 6.0 …8.8
• CVE-2026-1531A flaw was found in foreman_kubevirt. When configuring the c…8.1
• CVE-2026-15310When decompressing crafted zip files using the bzip/LZMA/Zst…2.1
• CVE-2026-15311A vulnerability was identified in NousResearch hermes-agent …3.5
• CVE-2026-15312The Propovoice: All-in-One Client Management System plugin f…8.8
• CVE-2026-15314Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary …7.5
• CVE-2026-15315Tapo C120 v1 and C200 v5 contain an improper authentication …8.8