Release date:
2026-07-24 09:29:30 UTC
Description:
* CVE-2026-15308: fix quadratic-complexity CPU denial-of-service in
html.parser.HTMLParser incremental parsing. When an unterminated
construct (tag or comment) spanned many feed() calls, the growing
buffer was rescanned and concatenated on every call. New data is now
accumulated in a list and only joined and parsed once enough has piled
up; close() flushes any buffered data before the final parse.
- debian/patches/CVE-2026-15308.patch: backport upstream
bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 (gh-153030 / gh-153031).
Updated packages:
-
alt-python38_3.8.20-23_amd64.deb
sha:e19ed4a5b7ce3e3f6e30afc184660106132b7b65
-
alt-python38-debug_3.8.20-23_amd64.deb
sha:4e4d505f64d0fd0fd77cd17bd5eb6e1dab01feec
-
alt-python38-devel_3.8.20-23_amd64.deb
sha:d4d0294dea9c877219f20c2dbd1c7758982cc633
-
alt-python38-idle_3.8.20-23_amd64.deb
sha:04d95e86275db07c73cd2c7d3ad2805db081f72e
-
alt-python38-libs_3.8.20-23_amd64.deb
sha:2bd68a4e213ffe7f6a8e22a34434bc9840659ee8
-
alt-python38-test_3.8.20-23_amd64.deb
sha:21af60fa46fe7a25c20167941c355a1f4fb6b244
-
alt-python38-tkinter_3.8.20-23_amd64.deb
sha:d0456533a2494a2ef6242fb99209a681e1d9f0d2
-
alt-python38_3.8.20-23_arm64.deb
sha:23bde60fbb62bdd3e5b72a6ca76d286b8c3354bc
-
alt-python38-debug_3.8.20-23_arm64.deb
sha:dd2fd2edd872c0f231ca84abf662483275dffbe5
-
alt-python38-devel_3.8.20-23_arm64.deb
sha:557d92f9c6d4a5865e5ead4c2f14a7c480fa5d0c
-
alt-python38-idle_3.8.20-23_arm64.deb
sha:fa8f5f6922b768f8e92120749c78a747278e1e06
-
alt-python38-libs_3.8.20-23_arm64.deb
sha:1ba988906cb60b352b72343b2d9d2a6c6dbb75ff
-
alt-python38-test_3.8.20-23_arm64.deb
sha:630e0968ce852cb69955f8f012abb21557798d82
-
alt-python38-tkinter_3.8.20-23_arm64.deb
sha:14f70992e9ecb7fdc449cd6ae878e988076e9c78
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
