CVE-2026-15308
Detail
Modified After Enrichment This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CNA: Python Software Foundation
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.x Severity and Vector Strings:
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Weakness Enumeration
CWE-ID
CWE Name
Source
NVD-CWE-noinfo
Insufficient Information
NIST
CWE-400
Uncontrolled Resource Consumption
Python Software Foundation
Change History
11 change records found show changes
CVE Modified by Python Software Foundation
8/10/2026 9:17:19 PM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
Added
Reference
https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00
CVE Modified by Python Software Foundation
8/05/2026 9:16:29 PM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.13.15","versionType":"python","status":"affected"},{"version":"3.14.0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
8/05/2026 10:17:03 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
8/04/2026 9:16:44 PM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
CVE Modified by Python Software Foundation
7/23/2026 3:16:53 PM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
Initial Analysis by NIST
7/10/2026 4:07:52 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Added
CWE
NVD-CWE-noinfo
Added
CPE Configuration
OR
*cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions up to (excluding) 3.15.0
Added
Reference Type
CVE: http://www.openwall.com/lists/oss-security/2026/07/09/4 Types: Third Party Advisory
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9 Types: Patch
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced Types: Patch
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 Types: Patch
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd Types: Patch
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/issues/153030 Types: Patch
Added
Reference Type
Python Software Foundation: https://github.com/python/cpython/pull/153031 Types: Issue Tracking, Patch
Added
Reference Type
Python Software Foundation: https://mail.python.org/archives/list/[email protected] /thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/ Types: Mailing List
CVE Modified by CVE
7/09/2026 4:16:29 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.openwall.com/lists/oss-security/2026/07/09/4
CVE Modified by Python Software Foundation
7/09/2026 3:17:04 PM
Action
Type
Old Value
New Value
Added
CVSS V4.0
AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Removed
CVSS V4.0
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE Modified by CISA-ADP
7/09/2026 2:16:51 PM
Action
Type
Old Value
New Value
Added
SSVC
{"timestamp":"2026-07-09T17:31:19.781935Z","id":"CVE-2026-15308","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}
CVE Modified by Python Software Foundation
7/09/2026 2:16:51 PM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
Added
Reference
https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
Added
Reference
https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
Added
Reference
https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
New CVE Received from Python Software Foundation
7/09/2026 1:16:58 PM
Action
Type
Old Value
New Value
Added
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data.
Added
CVSS V4.0
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added
CWE
CWE-400
Added
Reference
https://github.com/python/cpython/issues/153030
Added
Reference
https://github.com/python/cpython/pull/153031
Added
Reference
https://mail.python.org/archives/list/[email protected] /thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
Added
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["html.parser","html"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-15308 NVD
Published Date: 07/09/2026 NVD
Last Modified: 08/10/2026
Source: Python Software Foundation
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
