CVE-2026-15308 @ Saiph
Status
accepted_risk
Priority
0.62
Match score
4.0
Risk
DoS
Remote
CVSS
7.5 HIGH
Reason
cpe: python; pkgs: python, python-crypto, python-dnspython, python-gpg, python-ldb, python-minimal; version: in-range: python-stdlib-2.7.16-1, python-2.7.16-1, python-crypto-2.6.1-9+b1, python-dnspython-1.16.0-1+deb10u1, python-gpg-1.12.0-6, python-ldb-1.5.1+really1.4.6-3+deb10u1; risk:dos
Created
2026-08-03T17:04:48Z
Updated
2026-08-22T10:15:33Z
Closed
2026-08-03T18:07:44Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| python-stdlib-2.7.16-1 | |
| python-2.7.16-1 | |
| python-crypto-2.6.1-9+b1 | |
| python-dnspython-1.16.0-1+deb10u1 | |
| python-gpg-1.12.0-6 | |
| python-ldb-1.5.1+really1.4.6-3+deb10u1 | |
| python-minimal |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: python-stdlib · python · python-crypto · python-dnspython · python-gpg · python-ldb · python-minimal
| System | Matches | Ticket for CVE-2026-15308 | |
|---|---|---|---|
| Archive | python-crypto 2.6.1-9+b1 | accepted_risk open | |
| Library | python-crypto 2.6.1-7 | accepted_risk open | |
| Saiph | python-crypto 2.6.1-9+b1 | accepted_risk open |
Same product CVEs in your queue
Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2026-68770 | 9.8 | morris, mufasa | does_not_affect | python | — | ||
| CVE-2026-3644 | 7.5 | Archive, Library, Matrix, Saiph, morris … | accepted_risk, does_not_affect | python | — | ||
| CVE-2026-4224 | 7.5 | Archive, Library, Saiph, morris, mufasa | accepted_risk, does_not_affect | python | — | ||
| CVE-2026-7210 | 7.5 | Archive, Library, Matrix, Saiph, morris … | accepted_risk, not_applicable | python | → CVE-2026-15308 | linked here | |
| CVE-2026-59939 | 7.5 | Bullseye, Matrix, Silk | new | python | — | ||
| CVE-2026-30922 | 7.5 | Library | not_applicable | python | → CVE-2026-59884 | ||
| CVE-2026-59886 | 7.5 | Library | not_applicable | python | → CVE-2026-59884 | ||
| CVE-2026-7246 | 7.2 | Silk | does_not_affect | python | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Other CVEs related to this one as primary:
| Related CVE | Note | Tickets |
|---|---|---|
| CVE-2026-7210 | same product as CVE-2026-15308 | morris, mufasa, Library, Matrix, Archive, Saiph |
Host OS / kernel
OS
Debian GNU/Linux 10 (buster)
(10)
· debian
Arch
x86_64
kernel_release
uname -r → 4.19.0-27-amd64kernel_version
uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | accepted_risk | 7.0 | 2026-08-22T10:15:33Z | Open |
| mufasa | accepted_risk | 7.0 | 2026-08-22T10:15:33Z | Open |
| Library | accepted_risk | 1.75 | 2026-08-22T10:15:33Z | Open |
| Matrix | accepted_risk | 1.75 | 2026-08-22T10:15:33Z | Open |
| Archive | accepted_risk | 0.62 | 2026-08-22T10:15:33Z | Open |
Description
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Determination
Vulnerability: CPU denial-of-service in Python’s incremental HTML parser (html.parser.HTMLParser). Cause: Processing repeated unterminated markup declarations can cause excessive CPU usage (quadratic behavior). Impact: Availability only (DoS). No remote code execution or data breach. Affected: Essentially all CPython versions that include the HTML parser, including Python 2.7. These servers have no public use that would cause this issue. Only high CPU is risk.
Update status
Add note only
Mitigation log
2026-08-03T17:28:14Z — affects
Vulnerability: CPU denial-of-service in Python’s incremental HTML parser (html.parser.HTMLParser).
Cause: Processing repeated unterminated markup declarations can cause excessive CPU usage (quadratic behavior).
Impact: Availability only (DoS). No remote code execution or data breach.
Affected: Essentially all CPython versions that include the HTML parser, including Python 2.7.
2026-08-03T18:07:44Z — accepted_risk
These servers have no public use that would cause this issue. Only high CPU is risk.
References
- https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
- https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7
- https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
- https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
- https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
- https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00
- https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
- https://github.com/python/cpython/issues/153030
- https://github.com/python/cpython/pull/153031
- https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
- http://www.openwall.com/lists/oss-security/2026/07/09/4
NVD: CVE-2026-15308