CVE-2026-15308: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-15308 is a CPU denial-of-service vulnerability in Python's incremental HTML parser (html.parser.HTMLParser) caused by quadratic complexity when processing repeated unterminated markup declarations across multiple feed() calls. It affects CPython versions prior to 3.15.0b4 (all maintained branches including 3.10, 3.11, 3.12, 3.13, and 3.14 are impacted). The vulnerability was disclosed on July 9, 2026, with the fix merged on July 4, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) combined with a loop with an unreachable exit condition (CWE-835). When an unterminated HTML construct (e.g., a tag, comment, doctype, or CDATA section) spans many feed() calls, the parser rescans the growing internal buffer and concatenates new data onto it on every call — both operations being O(n²) in the total input size. The fix accumulates new data in a list and only joins and parses it once a threshold is reached, and doubles the threshold when nothing is parsed, preventing the quadratic blowup. An unauthenticated attacker with network access to any service that passes user-controlled HTML to HTMLParser can trigger this behavior with a specially crafted payload of repeated unterminated markup declarations (CPython PR #153031, CPython Issue #153030).

Successful exploitation causes excessive CPU consumption on the affected Python process, leading to service hangs or crashes — a pure availability impact with no confidentiality or integrity consequences. Any application that parses untrusted or user-supplied HTML using html.parser.HTMLParser is at risk, including web scrapers, HTML sanitizers, email processors, and web frameworks relying on this standard library module. The attack is network-reachable, requires no authentication, and is automatable, making it suitable for large-scale denial-of-service campaigns against exposed services (Github Advisory, Red Hat Bugzilla).

1. Identify a target: Find a network-accessible service that uses Python's html.parser.HTMLParser to process user-supplied HTML input (e.g., a web application with an HTML preview, sanitization endpoint, or scraping service).
2. Craft a malicious payload: Construct an HTML document containing a large number of repeated unterminated markup declarations, such as <! sequences without closing >, or unterminated tags/comments fed incrementally. For example, a string like <! repeated thousands of times without termination.
3. Deliver the payload incrementally: Submit the crafted HTML to the target service in chunks (e.g., via HTTP POST with chunked transfer encoding or repeated API calls), causing the parser's feed() method to be called many times with growing unterminated constructs.
4. Trigger CPU exhaustion: Each feed() call causes the parser to rescan the entire accumulated buffer quadratically, consuming CPU proportional to O(n²) of the total input, eventually hanging or crashing the service process (CPython PR #153031, CPython Issue #153030).

• Network: Unusually large or repeated HTTP requests to endpoints that accept HTML input; chunked transfer encoding requests with many small fragments containing <! or similar unterminated markup patterns.
• Process: Python processes consuming 100% CPU for extended periods without completing; processes associated with HTML parsing services becoming unresponsive or timing out.
• Logs: Application logs showing HTML parsing operations that never complete or time out; repeated requests from the same source IP to HTML-processing endpoints; error logs indicating worker process crashes or restarts due to resource exhaustion.
• System: Elevated CPU load on servers running Python-based web applications or HTML processing pipelines; operating system OOM events or process kills targeting Python interpreter processes.

Upgrade CPython to a patched version: the fix was backported to branches 3.10, 3.11, 3.12, 3.13, 3.14, and 3.15 via commits bcf98dd (main), 07efb08 (3.14), 7933f4b (3.13), and e9f92ac (3.15) (CPython PR #153031). Red Hat has issued errata for RHEL 8, 9, and 10 (RHSA-2026:39183, RHSA-2026:39320, RHSA-2026:39771, RHSA-2026:39798, RHSA-2026:39893, RHSA-2026:40856, RHSA-2026:41949) (Red Hat Bugzilla). As interim workarounds: enforce size limits on HTML input before passing it to HTMLParser; implement parsing timeouts; and restrict HTML parsing to trusted sources where possible.

The Python Security Announce mailing list published the official disclosure at mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/, and the issue was also reported to the oss-security list. Red Hat rated the issue as high severity and rapidly issued errata across RHEL 8, 9, and 10 within days of disclosure (Red Hat Bugzilla). Community discussion on Bluesky and security aggregators noted the vulnerability's broad impact given the ubiquity of html.parser.HTMLParser in Python applications, though overall reaction was measured given the absence of active exploitation.