Release date:
2026-07-23 10:15:50 UTC
Description:
* SECURITY UPDATE: quadratic-complexity CPU DoS in incremental HTML parsing
- debian/patches/CVE-2026-15308.patch: port of cpython gh-153030
(GH-153031). HTMLParser.feed() (Lib/HTMLParser.py) previously
concatenated new data onto the unparsed buffer and re-scanned it from
the start on every call, so feeding an unterminated construct in many
small chunks was quadratic. New data is now accumulated in a list and
only joined and parsed once enough has piled up; close() flushes the
pending buffer.
- CVE-2026-15308
Updated packages:
-
alt-python27_2.7.18-25_amd64.deb
sha:90bc928160891703127445fdd13e5e8691c2f39e
-
alt-python27-debug_2.7.18-25_amd64.deb
sha:ecfb8f2a2a30d2d70913967e4c85e95d63bdd60c
-
alt-python27-devel_2.7.18-25_amd64.deb
sha:340023b39dc05fe88f78f11c4d94b41628406980
-
alt-python27-idle_2.7.18-25_amd64.deb
sha:13fb7d79ead951ce40a3c54c000502e208061128
-
alt-python27-libs_2.7.18-25_amd64.deb
sha:a35904b718760751698f3130201645b58d0c88a4
-
alt-python27-test_2.7.18-25_amd64.deb
sha:745f81f86de339650a1c548acc92555991cdaf52
-
alt-python27-tkinter_2.7.18-25_amd64.deb
sha:de9d398c0f6710696891c56d9bbb70ba9f1c96f0
-
alt-python27-tools_2.7.18-25_amd64.deb
sha:0aa118c9fb797b04d9e85cfc1eb1048be694a74c
-
alt-python27_2.7.18-25_arm64.deb
sha:699334538e429f43ea36cb3b29623bfac7860eb4
-
alt-python27-debug_2.7.18-25_arm64.deb
sha:220b1a2f11be6428e514d9db30c213794bd2c074
-
alt-python27-devel_2.7.18-25_arm64.deb
sha:f42e4105e1d2167c0a2cb8bc04f99d5c8a8b65cd
-
alt-python27-idle_2.7.18-25_arm64.deb
sha:77147e0bf3f059cfc4052dec6d279bb06cc30c26
-
alt-python27-libs_2.7.18-25_arm64.deb
sha:5368b410b1b764b417ae47915d903716e8b2ed6b
-
alt-python27-test_2.7.18-25_arm64.deb
sha:d489466d9e76d381466fa9835bd7ded1391564c1
-
alt-python27-tkinter_2.7.18-25_arm64.deb
sha:206374030e82608a6089d43d22b00de6122b6117
-
alt-python27-tools_2.7.18-25_arm64.deb
sha:60e0a93e854d987b64e14adc711148f7fb4b3e4c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
