Skip to main content

CPython CVE-2026-15308

| EUVDEUVD-2026-42638 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-09 cna@python.org GHSA-7qj2-q5c8-cxx5
Denial Of Service Python
8.7
CVSS 4.0 · Vendor: python
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify endpoint parsing untrusted HTML
  2. Delivery
    Send unterminated markup in many small chunks
  3. Exploit
    Trigger quadratic rescan and buffer copy in feed()
  4. Execution
    Exhaust CPU on parsing worker
  5. Impact
    Service degradation or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target application to pass attacker-controlled ('uncontrolled') data into html.parser.HTMLParser, ideally via incremental feed() calls, and to leave the input unbounded in size. The concrete trigger is any long UNTERMINATED markup construct - an open comment '<!--', processing instruction '<?', '<!doctype ', CDATA '<![CDATA[', an unterminated start tag, or an open RAWTEXT element like '<script>' - with no closing delimiter. No authentication and no user interaction are needed (CVSS PR:N/UI:N), and the attack is network-reachable (AV:N) and automatable per SSVC. Limiting factors: the application must actually route untrusted input through HTMLParser (services parsing only trusted/controlled HTML are not realistically exposed), the interpreter must be older than CPython 3.16.0, and any pre-parser input-size cap or parse timeout blunts the DoS. Impact is confined to availability (CPU/time exhaustion) - no data disclosure or code execution.
Impact

Signals are consistent and point to a real but availability-only concern. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:H) correctly captures a remote, unauthenticated, low-complexity attack whose sole impact is availability - no confidentiality or integrity loss, no code execution. CISA's SSVC framework agrees: Exploitation 'none' (not observed in the wild), Automatable 'yes' (a single crafted stream reliably triggers it and can be scripted at scale), Technical Impact 'partial' (degradation, not full takeover). No KEV listing and no independently published exploit, so this is not an emergency, but Automatable=yes plus a public patch/test that reveals the exact trigger means weaponization is easy. Real priority is highest for internet-facing services that parse untrusted HTML through HTMLParser; for code that only parses trusted/controlled input the practical risk is low. Note: the 8.7/High score is driven entirely by the availability leg - it should not be read as a critical-impact flaw. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be cross-checked.
Exploit ScenarioDerived

An attacker submits an HTTP request (or uploads content) to a Python web service that streams the body through HTMLParser.feed() - for example an HTML sanitizer or link-preview fetcher. The payload is a single unterminated construct such as '<!--' followed by hundreds of thousands of characters and never closed; each buffered chunk forces the parser to re-copy and re-scan the growing buffer, driving CPU to O(n²) and hanging the worker. No public exploit is identified, but the upstream regression test (feeding '<!--' + 200,000 chunks of 64 'a's) is effectively a ready-made reproducer.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 09, 2026

CPU-exhaustion denial of service in CPython's standard-library html.parser.HTMLParser lets remote attackers cause quadratic processing time by feeding a long, unterminated markup construct (comment, tag, PI, DOCTYPE, CDATA, or RAWTEXT element) incrementally in many small chunks. Any Python service that streams attacker-controlled HTML through HTMLParser.feed() is affected in all CPython versions before 3.16.0. There is no public exploit identified at time of analysis, but the fix, root cause (repeated buffer rescan and concatenation), and a triggering test case are publicly documented in the upstream pull request, making a working reproducer trivial to reconstruct.

Earlier versions of this analysis (2)
v2 Jul 09, 2026 - 19:32 cvss changed CVSS 8.7

CPU-exhaustion denial of service in Python's standard-library html.parser.HTMLParser affects all CPython releases before 3.16.0. When an application feeds attacker-controlled data incrementally (many feed() calls) containing a long unterminated markup construct - a comment, processing instruction, doctype, CDATA section, start tag, or RAWTEXT element - the parser re-scans and re-concatenates the growing unparsed buffer on every call, producing quadratic O(n²) work that pins a CPU core. No public exploit identified at time of analysis, though the upstream fix ships a reproducer test; SSVC rates exploitation as none but automatable, and a vendor patch is available in 3.16.0.

v1 Jul 09, 2026 - 17:30 CVSS 10.0

CPU exhaustion denial-of-service in CPython's standard-library html.parser.HTMLParser lets remote unauthenticated attackers stall applications that parse untrusted HTML by supplying repeated unterminated markup declarations, forcing pathological parsing work. Any Python service that feeds attacker-controlled or uncontrolled data through HTMLParser (scrapers, sanitizers, feed/email processors, web frameworks) is affected. Reported by the Python Software Foundation with a public issue and fix pull request; no public exploit identified at time of analysis and it is not in CISA KEV, so this is a resource-exhaustion bug rather than a memory-safety compromise despite the inflated 10.0 input score.

RemediationAI

Upgrade the Python interpreter to CPython 3.16.0 or later, which contains the fix (commits 07efb08, 7933f4b, bcf98dd, e9f92ac; PR python/cpython#153031); watch the python-security-announce thread for corresponding maintenance-branch backport releases (3.13.x/3.14.x/3.15.x) if you cannot move to 3.16. Patch status: patch available per vendor advisory / upstream fix merged. Where you cannot upgrade immediately, apply targeted compensating controls at the parsing boundary: cap the total number of bytes accepted per HTMLParser instance and per feed() session (e.g. reject inputs beyond a few hundred KB), enforce a wall-clock/CPU timeout around parse operations, and rate-limit or size-limit HTTP request bodies before they reach the parser - trade-off is that legitimate very-large HTML documents may be rejected or truncated. For untrusted feeds, consider switching to a hardened parser (e.g. lxml) or parsing in an isolated worker with resource (RLIMIT_CPU) limits so a single malicious stream cannot starve the main process. See the oss-security advisory https://seclists.org/oss-sec/2026/q3/110 for details.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is html.parser.HTMLParser, a pure-Python incremental HTML tokenizer in the CPython standard library used widely for scraping, sanitization, and feed/HTML processing. Root cause is CWE-400 (Uncontrolled Resource Consumption): the pre-3.16 feed() implementation did 'self.rawdata = self.rawdata + data' and then called goahead(0) on every call. When a construct is unterminated, goahead cannot consume the buffer, so each incremental feed re-concatenates the entire accumulated buffer (O(n) copy) and re-scans it from the start looking for a terminator - yielding overall O(n²) CPU and memory-copy cost as the buffer grows. The upstream fix (PR python/cpython#153031, gh-issue-153030) introduces a pending-chunk accumulator with a doubling parse threshold, so an unparseable buffer is only rejoined/rescanned after it doubles, amortizing the work back to near-linear. The EUVD entry scopes this to CPython (cpe: the CPython interpreter) versions below 3.16.0.

Know when Python gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (python) PRIMARY 8.7 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.5 HIGH

Remote unauthenticated attacker feeds untrusted HTML with low complexity (AV:N/AC:L/PR:N/UI:N); impact is pure CPU-exhaustion DoS, so A:H with C:N/I:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (python).

CVSS VectorVendor: python

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 09, 2026 - 19:32 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 09, 2026 - 19:32 vuln.today
v2 - CVSS changed
Severity Changed
Jul 09, 2026 - 19:22 NVD
CRITICAL HIGH
CVSS changed
Jul 09, 2026 - 19:22 NVD
10.0 (CRITICAL) 8.7 (HIGH)
Patch available
Jul 09, 2026 - 18:01 EUVD

DescriptionCVE.org

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Executive ViewAI

Why It Matters

CVE-2026-15308 enables remote denial-of-service attacks that could disrupt service availability for any organization running Python applications that process HTML, affecting all CPython versions before 3.16.0. The attack requires minimal resources and no credentials; while no public exploit code currently exists, the attack method is trivial to implement from publicly documented technical details. Patching all affected Python services is urgent to prevent availability incidents.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Prevalence
Ubiquitous
html.parser ships in every CPython install; Python is deployed almost everywhere
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:37533 ADVISORY https://access.redhat.com/errata/RHSA-2026:37535 ADVISORY https://access.redhat.com/errata/RHSA-2026:38017 ADVISORY https://access.redhat.com/errata/RHSA-2026:38018 ADVISORY https://access.redhat.com/errata/RHSA-2026:39183 ADVISORY https://access.redhat.com/errata/RHSA-2026:39320 ADVISORY https://access.redhat.com/errata/RHSA-2026:39771 ADVISORY https://access.redhat.com/errata/RHSA-2026:39798 ADVISORY https://access.redhat.com/errata/RHSA-2026:39893 ADVISORY https://access.redhat.com/errata/RHSA-2026:40856 ADVISORY https://access.redhat.com/errata/RHSA-2026:41949 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15308 ADVISORY https://seclists.org/oss-sec/2026/q3/110 ADVISORY https://ubuntu.com/security/notices/USN-8744-1 ADVISORY https://vuldb.com/vuln/377242 REF http://www.openwall.com/lists/oss-security/2026/07/09/4 REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 REF https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7 REF https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14 REF https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced REF https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 REF https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00 REF https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd REF https://github.com/python/cpython/issues/153030 REF https://github.com/python/cpython/pull/153031 REF https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy