- CVE-2026-15308: fix quadratic-complexity CPU denial-of-service in incremental HTML parsing (Lib/HTMLParser.py). feed() previously concatenated new data onto the unparsed buffer and re-scanned it from the start on every call, so feeding an unterminated construct in many small chunks was quadratic. New data is now accumulated in a list and only joined and parsed once enough has piled up, with close() flushing the pending buffer. Port of gh-153030 (GH-153031).