Release date:
2026-07-29 09:46:10 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be
driven into quadratic-time CPU consumption. Each feed() concatenated new
data onto the unparsed buffer and re-scanned it from the start, so feeding
a long unterminated construct (tag, comment, declaration, PI, CDATA) in
many small chunks was quadratic in the input size — a denial of service
(CWE-407).
- debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4
(gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71).
feed() now accumulates incoming data in a list and only joins and
parses it once the buffer has doubled, and close() flushes any pending
data before the final scan.
- CVE-2026-15308
Updated packages:
-
alt-python39_3.9.23-22_amd64.deb
sha:e81d8b6e87c33cfb56b2144db0a2875bad79e2ac
-
alt-python39-debug_3.9.23-22_amd64.deb
sha:346f4a2c73598b4f9141c5e2185d5b452db4ff30
-
alt-python39-devel_3.9.23-22_amd64.deb
sha:36303be4c34d4341522ccac1dedabb125fef7acc
-
alt-python39-idle_3.9.23-22_amd64.deb
sha:c2dfce396a3ead35b4710a68b5eddbe2f8beea45
-
alt-python39-libs_3.9.23-22_amd64.deb
sha:019a3d5a86595c4ce99ce434b74a51dca7c34765
-
alt-python39-test_3.9.23-22_amd64.deb
sha:482789aa1c96132bafdf6a3e75b8b71ad7b91ec7
-
alt-python39-tkinter_3.9.23-22_amd64.deb
sha:baa6241967aada1abaf719cbeeb3dee244dd510b
-
alt-python39_3.9.23-22_arm64.deb
sha:889b96e455066aa31045ccab2f13ffb4603f7b84
-
alt-python39-debug_3.9.23-22_arm64.deb
sha:4c33d3526632d0926791b0bcde45479293cac8f3
-
alt-python39-devel_3.9.23-22_arm64.deb
sha:55483d6d967e93b503a5f01e5e8fc9d5b6abd065
-
alt-python39-idle_3.9.23-22_arm64.deb
sha:b0a1d3cff6c90974ff45a6e4d55b58b632b64a48
-
alt-python39-libs_3.9.23-22_arm64.deb
sha:4d5298879780779f51792eb585c39e35d9702876
-
alt-python39-test_3.9.23-22_arm64.deb
sha:a1df230dded60eb47643bf01c6f3b126c4740456
-
alt-python39-tkinter_3.9.23-22_arm64.deb
sha:e006f90b3a2d9b7eebd365a434c4be55c1685b98
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
