- CVE-2026-15308: html.parser.HTMLParser incremental parsing was quadratic when an unterminated construct (tag or comment) spanned many feed() calls, because the growing buffer was rescanned and concatenated on every call -- a CPU denial-of-service on attacker-controlled input. New data is now accumulated in a list and only joined and parsed once enough has piled up; close() flushes any buffered data before the final parse.