Release date:
2026-07-23 16:42:40 UTC
Description:
* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be
driven into quadratic-time CPU consumption. Each feed() concatenated new
data onto the unparsed buffer and re-scanned it from the start, so feeding
a long unterminated construct (tag, comment, declaration, PI, CDATA) in
many small chunks was quadratic in the input size — a denial of service
(CWE-407).
- debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4
(gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71).
feed() now accumulates incoming data in a list and only joins and
parses it once the buffer has doubled, and close() flushes any pending
data before the final scan.
- CVE-2026-15308
Updated packages:
-
alt-python39_3.9.23-22_amd64.deb
sha:ed4813da17d269365222ff6c25921bd0341e8c1c
-
alt-python39-debug_3.9.23-22_amd64.deb
sha:39be1bef9963e0956f95ef8dbae6905144d7eeb8
-
alt-python39-devel_3.9.23-22_amd64.deb
sha:4266adb33f5530e9e2de77a29a8175603a0c5646
-
alt-python39-idle_3.9.23-22_amd64.deb
sha:adc281f10f07f96cd16f8300dab62c2169b09485
-
alt-python39-libs_3.9.23-22_amd64.deb
sha:cff3a955025e57b17198c539e314b00cba68fa37
-
alt-python39-test_3.9.23-22_amd64.deb
sha:6b507dcf378acb4321d48e68448b90a13bf8fb0d
-
alt-python39-tkinter_3.9.23-22_amd64.deb
sha:32dd579d1b19721d05251e4e03f659344f23f4f9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
