Release date:
2026-07-22 12:52:01 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser was vulnerable to a
quadratic-complexity CPU denial of service. Feeding an unterminated
markup construct (e.g. a tag or comment) in many small chunks made
feed() re-scan and re-concatenate the growing unparsed buffer on
every call, which is quadratic in the input size.
- debian/patches/CVE-2026-15308.patch: backport of cpython
bcf98ddb (gh-153030). Accumulates incoming data in a list and
only joins/parses it once enough has piled up, flushing any
pending data in close().
- CVE-2026-15308
Updated packages:
-
alt-python37_3.7.17-26_amd64.deb
sha:0da29c5e44f45c440ef13cea76405f177059780e
-
alt-python37-debug_3.7.17-26_amd64.deb
sha:593c84e794d2bef2a3480bb39f17cfacb63068f5
-
alt-python37-devel_3.7.17-26_amd64.deb
sha:332ebb8b8d0a3094de013c6a53efcb818a2793d2
-
alt-python37-libs_3.7.17-26_amd64.deb
sha:93e012ede3ba9414d7199b46f83ec20756918dcc
-
alt-python37-test_3.7.17-26_amd64.deb
sha:5ee71d6b226f2841f9f9ac95e6fbfe303353acf8
-
alt-python37-tkinter_3.7.17-26_amd64.deb
sha:fab7cc45674ad528b3683a8ef0d2ec76da6a35d9
-
alt-python37-tools_3.7.17-26_amd64.deb
sha:e0573e27b4bd2a1b86370fa63a605cd30feca1ab
-
alt-python37_3.7.17-26_arm64.deb
sha:4db5a16a98d2f70af02f0b464ededb3df7ad3a68
-
alt-python37-debug_3.7.17-26_arm64.deb
sha:e7c2f69f8d41764d26ca36a58cfc5278c40daa38
-
alt-python37-devel_3.7.17-26_arm64.deb
sha:1f948b98dbba51d9d6542f2e338e8a769f2b4d74
-
alt-python37-libs_3.7.17-26_arm64.deb
sha:8274613113de9b59a9c61780e2548d6bc0f0d843
-
alt-python37-test_3.7.17-26_arm64.deb
sha:a838d175d7dfa2c5ad2b606595250329936d859c
-
alt-python37-tkinter_3.7.17-26_arm64.deb
sha:1dd0832f80e92570810eb41ed712b758a42a7ad4
-
alt-python37-tools_3.7.17-26_arm64.deb
sha:5c820c7e86974b064b9e4f25a9a0d69ac568777b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
