UnratedFix available
Fix CVE(s): CVE-2026-15308
Type: advisorySources: OSV
* SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and rescan it once a growing threshold is reached, so an unterminated construct (tag, comment, PI, doctype, CDATA, RAWTEXT element) spread across many feed() calls no longer makes both the buffer concatenation and the rescan quadratic in the input size (backport of upstream commit bcf98ddbc40e, gh-153030 / GH-153031). - CVE-2026-15308
- Products
- idle-python3.7, libpython3.7, libpython3.7-dev, libpython3.7-minimal, libpython3.7-stdlib, libpython3.7-testsuite, python3.7, python3.7-dev, python3.7-doc, python3.7-examples, python3.7-minimal, python3.7-venv
- Affected versions
- Not specified
- Fixed versions
- 3.7.3-2+deb10u7+tuxcare.els6
- CVEs
- CVE-2026-15308
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:21 UTC · Revision 1
Source evidence
* SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and rescan it once a growing threshold is reached, so an unterminated construct (tag, comment, PI, doctype, CDATA, RAWTEXT element) spread across many feed() calls no longer makes both the buffer concatenation and the rescan quadratic in the input size (backport of upstream commit bcf98ddbc40e, gh-153030 / GH-153031). - CVE-2026-15308
osv:CLSA-2026-1784188935
idle-python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
libpython3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
libpython3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
libpython3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
libpython3.7-stdlib
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
libpython3.7-testsuite
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7-doc
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7-examples
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
python3.7-venv
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els6
Complete source record
{
"id": "f55bd2313860e12b6bcc47eb501c04d3a11addcfb4237237d79aa95e5834ea56",
"url": "https://osv.dev/vulnerability/CLSA-2026-1784188935",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2026-15308",
"summary": "* SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and rescan it once a growing threshold is reached, so an unterminated construct (tag, comment, PI, doctype, CDATA, RAWTEXT element) spread across many feed() calls no longer makes both the buffer concatenation and the rescan quadratic in the input size (backport of upstream commit bcf98ddbc40e, gh-153030 / GH-153031). - CVE-2026-15308",
"evidence": "osv:CLSA-2026-1784188935",
"products": [
{
"name": {
"value": "idle-python3.7",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-dev",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-minimal",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-stdlib",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-testsuite",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-doc",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-examples",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-minimal",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-venv",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els6",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1784188935",
"aliases": [
"CLSA-2026-1784188935"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "idle-python3.7",
"purl": "pkg:deb/tuxcare/idle-python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "libpython3.7",
"purl": "pkg:deb/tuxcare/libpython3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "libpython3.7-dev",
"purl": "pkg:deb/tuxcare/libpython3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "libpython3.7-minimal",
"purl": "pkg:deb/tuxcare/libpython3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "libpython3.7-stdlib",
"purl": "pkg:deb/tuxcare/libpython3.7-stdlib?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "libpython3.7-testsuite",
"purl": "pkg:deb/tuxcare/libpython3.7-testsuite?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7",
"purl": "pkg:deb/tuxcare/python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7-dev",
"purl": "pkg:deb/tuxcare/python3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7-doc",
"purl": "pkg:deb/tuxcare/python3.7-doc?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7-examples",
"purl": "pkg:deb/tuxcare/python3.7-examples?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7-minimal",
"purl": "pkg:deb/tuxcare/python3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els6"
}
]
}
],
"package": {
"name": "python3.7-venv",
"purl": "pkg:deb/tuxcare/python3.7-venv?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784188935.json"
}
}
],
"modified": "2026-10-26T09:31:52.512960310Z",
"provider": "osv",
"upstream": [
"CVE-2026-15308"
],
"references": [
"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1784188935.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
]
},
"related_cves": [
{
"value": "CVE-2026-15308",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448783,
"published_at": "2026-07-16T08:02:39+00:00"
}