Release date:
2026-07-29 09:52:27 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be
driven into quadratic-time CPU consumption. Each feed() concatenated new
data onto the unparsed buffer and re-scanned it from the start, so feeding
a long unterminated construct (tag, comment, declaration, PI, CDATA) in
many small chunks was quadratic in the input size — a denial of service
(CWE-407).
- debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4
(gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71).
feed() now accumulates incoming data in a list and only joins and
parses it once the buffer has doubled, and close() flushes any pending
data before the final scan.
- CVE-2026-15308
Updated packages:
-
alt-python39_3.9.23-22_amd64.deb
sha:a9f22ef4abd4a8aacb4687ab783df00804c8218d
-
alt-python39-debug_3.9.23-22_amd64.deb
sha:6747909ec229c05cb97a7f682ac00048b27f5673
-
alt-python39-devel_3.9.23-22_amd64.deb
sha:2459cf9dad44e7501932243a58cc3d44f9d56539
-
alt-python39-idle_3.9.23-22_amd64.deb
sha:25abb58951774514e0f234835af68ef706348d4a
-
alt-python39-libs_3.9.23-22_amd64.deb
sha:6a32f5535f717b3a8b4c9c2e7247fade9f17b955
-
alt-python39-test_3.9.23-22_amd64.deb
sha:548f5078045711a597310910f362ecb47d41cce5
-
alt-python39-tkinter_3.9.23-22_amd64.deb
sha:28c22ef63f4805ba97c51ef14401bdc600a6d397
-
alt-python39_3.9.23-22_arm64.deb
sha:195de1c342c3c9cc132fec6f62bf5b187a3429ba
-
alt-python39-debug_3.9.23-22_arm64.deb
sha:12338c6d921d9e9653b1047b753e1163bc98d77b
-
alt-python39-devel_3.9.23-22_arm64.deb
sha:45f607d6b8193aa27aa502f29ca4374d9b41fa3a
-
alt-python39-idle_3.9.23-22_arm64.deb
sha:efab57889ec0bcbd04e7a879b6dab87b46818934
-
alt-python39-libs_3.9.23-22_arm64.deb
sha:ce4762f759da90c13bed7eafed0f7fff43380c24
-
alt-python39-test_3.9.23-22_arm64.deb
sha:3cf711917e6e401f4ffd5807e8148850bc6575e9
-
alt-python39-tkinter_3.9.23-22_arm64.deb
sha:9355ac315d721b28c9615fd50cc7be1d6c430251
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
