Loading story…
Python disclosed CVE-2026-15308, a high-severity denial-of-service flaw in html.parser.HTMLParser that can drive CPU exhaustion when applications incrementally parse untrusted HTML containing repeated unterminated markup declarations. The bug stems from quadratic-time behavior in feed(), where small repeated chunks force expensive rescanning and buffer concatenation across malformed tags, comments, doctypes, CDATA sections, processing instructions, and RAWTEXT elements.
CPython maintainers shipped fixes and backports across supported branches including 3.10 through 3.15, with commits updating buffering logic to accumulate pending input more efficiently, defer reparsing until enough data arrives, adapt parsing thresholds based on parser progress, and flush buffered data on close(). The Python Software Foundation also updated the CVE record to clarify that affected versions are earlier than 3.15.0, not earlier than 3.16.0, while published metadata classifies the issue as CWE-400 and notes no known exploitation at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Python Software Foundation updated the CVE-2026-15308 record and changed the affected versions from CPython releases earlier than 3.16.0 to releases earlier than 3.15.0. The update was reflected in the CVE metadata on July 9, 2026.
Python security personnel publicly announced CVE-2026-15308, a high-severity denial-of-service vulnerability in html.parser.HTMLParser caused by repeated unterminated markup declarations during incremental parsing. The notice linked the CVE entry and the associated CPython fix.
A dedicated commit for the Python 3.15 branch backported the HTMLParser fix for quadratic-time incremental parsing. The patch addressed denial-of-service risk from malformed unterminated constructs and included a regression test.
CPython published security fix commits for the HTMLParser incremental parsing bug that could cause CPU-exhaustion denial of service via repeated small chunks of unterminated markup. The fixes changed buffering and reparsing behavior and added regression tests to prevent quadratic-time parsing.
A CPython issue describing worst-case quadratic complexity in incremental HTMLParser parsing was opened by serhiy-storchaka. The issue referenced the primary fix work and indicated planned backports across maintained Python branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CPython disclosed two medium-severity vulnerabilities affecting distinct parts of the runtime and tooling. **CVE-2026-1502** allows CR/LF bytes to pass through HTTP client proxy tunnel header or host handling, creating a header-injection risk in proxy tunnel scenarios. The issue was published through Python security channels and the `oss-sec` mailing list, with remediation details tracked in the CVE record and an associated CPython pull request. A second flaw, **CVE-2026-5713**, affects CPython remote debugging and introspection features and can trigger out-of-bounds read and write behavior when a privileged Python process connects to a malicious or compromised Python target. The bug impacts newer capabilities including `profiling.sampling` in Python 3.15+ and asyncio inspection commands such as ``` python -m asyncio ps python -m asyncio pstree ``` in Python 3.14+, and exploitation is expected to be unstable because the connecting process is likely to crash under ASLR.
Jun 29, 2026
A high-severity denial-of-service vulnerability, tracked as **`CVE-2026-49851`**, was disclosed in the Python Markdown parser **Mistune**. The flaw affects versions prior to **`3.3.0`** and allows attacker-controlled Markdown input to trigger excessive CPU consumption through quadratic-time parsing in `parse_link_text`. Inputs containing long runs of consecutive `[` characters can force repeated regex scans, causing parsing time to grow superlinearly and making the issue remotely exploitable in applications that process untrusted Markdown. The bug stems from an interaction in `mistune/inline_parser.py` where `InlineParser.parse()` advances one character at a time after `parse_link()` fails, while `parse_link_text()` rescans for a closing bracket on each attempt. A published proof of concept showed a 6,400-character payload increasing processing time to about 3.19 seconds, creating practical denial-of-service risk for web applications, APIs, and documentation platforms. Advisories classify the issue as **CWE-400: Uncontrolled Resource Consumption** and recommend upgrading to **Mistune `3.3.0` or later**; a proposed code-level fix is to return the furthest scanned position even on parse failure so the outer loop can skip ahead.
Jun 29, 2026
CPython fixed a medium-severity Server-Side Request Forgery issue in `Lib/ftplib.py` tracked as **CVE-2026-8328**, after maintainers found that `ftplib.ftpcp()` still trusted a source FTP server’s self-reported PASV IPv4 address. The flaw persisted because `ftpcp()` had not been updated during the earlier **CVE-2021-4189** remediation and continued to call `parse227()` directly, allowing an attacker-controlled FTP server to influence the host and port used for the target server’s data connection. The patch changes `ftpcp()` to use the source server’s actual peer address and to honor the existing `trust_server_pasv_ipv4_address` opt-out, bringing its behavior in line with `FTP.makepasv()`. Python linked the issue to advisory **GHSA-w8c5-q2xf-gf7c**; the fix was merged into the main branch and backported to multiple maintained releases after disclosure on Python’s security-announce list and redistribution through the `oss-security` mailing list.
Jun 29, 2026