CVE-2026-15308

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)

Description The incremental HTML parser html.parser.HTMLParser contains an issue that allows for CPU denial-of-service when processing uncontrolled data. The root cause is improper input handling that leads to pathological parsing behavior, specifically algorithmic complexity and resource exhaustion, when markup declarations are repeatedly left unterminated. An attacker can exploit this by providing crafted HTML to any service or pipeline using HTMLParser, which can result in CPU core exhaustion and the degradation or complete failure of affected applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.