Release date:
2026-07-22 08:00:12 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be
driven into quadratic-time CPU consumption. Each feed() concatenated new
data onto the unparsed buffer and re-scanned it from the start, so feeding
a long unterminated construct (tag, comment, declaration, PI, CDATA) in
many small chunks was quadratic in the input size — a denial of service
(CWE-407).
- debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4
(gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71).
feed() now accumulates incoming data in a list and only joins and
parses it once the buffer has doubled, and close() flushes any pending
data before the final scan.
- CVE-2026-15308
Updated packages:
-
alt-python39_3.9.23-22_amd64.deb
sha:264c8e76274949513a9329b5f543aff0bdbfad85
-
alt-python39-debug_3.9.23-22_amd64.deb
sha:cca40a46f799424faeef81819a62b07c8c2cfadb
-
alt-python39-devel_3.9.23-22_amd64.deb
sha:f8f37be44b1d185f9c1644a45d2efb3eee5ae0b6
-
alt-python39-idle_3.9.23-22_amd64.deb
sha:4e5116064d93061a3c925b9b75bbdfa63d4c8343
-
alt-python39-libs_3.9.23-22_amd64.deb
sha:583f7e54fe822b1ab8f838223b4d2ae52257ea94
-
alt-python39-test_3.9.23-22_amd64.deb
sha:33052735c5f3fef8bb5a4753a7f1e879bf3cd28d
-
alt-python39-tkinter_3.9.23-22_amd64.deb
sha:9bfa56e854daa3d8b1b5d420bda78777a9220f49
-
alt-python39_3.9.23-22_arm64.deb
sha:c1d8e39d3c0227cbcde39f6eb945b4b0b2d5d157
-
alt-python39-debug_3.9.23-22_arm64.deb
sha:c35da49605ac7c84a6fb18fa0aff9ffa6f0d34a0
-
alt-python39-devel_3.9.23-22_arm64.deb
sha:4b7f481539a5470d6ab2f60defb2913d41b3a2b8
-
alt-python39-idle_3.9.23-22_arm64.deb
sha:c38fef45b016bcbf162b822f7e6d955794b8c5d3
-
alt-python39-libs_3.9.23-22_arm64.deb
sha:8471e099c6b56ec535d74d8e296a1412c332d539
-
alt-python39-test_3.9.23-22_arm64.deb
sha:2da82240fb09ae4a70ebf493901e4ccf5af8b72f
-
alt-python39-tkinter_3.9.23-22_arm64.deb
sha:f17f7d1590bda4e7a5bd0115638528590d1c47d8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
