NVD Vulnerability Detail

CVE-2026-15308

Summary	The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Publication Date	July 10, 2026, 2:16 a.m.
Registration Date	July 10, 2026, 4:17 a.m.
Last Update	July 11, 2026, 5:07 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:python:python::::::::					3.15.0

Related information, measures and tools

No	URL	refsource
1	https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9	cna@python.org
2	https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced	cna@python.org
3	https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606	cna@python.org
4	https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd	cna@python.org
5	https://github.com/python/cpython/issues/153030	cna@python.org
6	https://github.com/python/cpython/pull/153031	cna@python.org
7	https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/	cna@python.org
8	http://www.openwall.com/lists/oss-security/2026/07/09/4	af854a3a-2127-422b-91ae-364da2661108

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Python Software FoundationのPythonにおけるリソースの枯渇に関する脆弱性

Title	Python Software FoundationのPythonにおけるリソースの枯渇に関する脆弱性
Summary	インクリメンタルHTMLパーサー（html.parser.HTMLParser）は、制御されていないデータを処理する際に、繰り返される未終了のマークアップ宣言によってCPUのサービス拒否（DoS）を引き起こす可能性があります。
Possible impacts	・当該ソフトウェアが扱う情報について、外部への漏えいは発生しません。・当該ソフトウェアが扱う情報について、書き換えは発生しません。・当該ソフトウェアが完全に停止する可能性があります。
Solution	ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 9, 2026, midnight
Registration Date	July 13, 2026, 11:29 a.m.
Last Update	July 13, 2026, 11:29 a.m.

Affected System

Python Software Foundation

Python 3.15.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2026-15308	https://www.cve.org/CVERecord?id=CVE-2026-15308
National Vulnerability Database (NVD)
2	CVE-2026-15308	https://nvd.nist.gov/vuln/detail/CVE-2026-15308

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html
2	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

ベンダー情報

No	Name	URL
Openwall mailing list archives
1	oss-security - [CVE-2026-15308] Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations	http://www.openwall.com/lists/oss-security/2026/07/09/4

その他

No	Name	URL
関連文書
1	Another worst case quadratic complexity in HTMLParser Issue #153030 python/cpython	https://github.com/python/cpython/issues/153030
2	gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser by serhiy-storchaka Pull Request #153031 python/cpython GitHub	https://github.com/python/cpython/pull/153031
3	gh-153030: Fix quadratic complexity in incremental parsing in HTMLPar… python/cpython@bcf98dd GitHub	https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
4	Mailman 3 [CVE-2026-15308] Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations - Security-announce - python.org	https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
5	[3.13] gh-153030: Fix quadratic complexity in incremental parsing in … python/cpython@7933f4b GitHub	https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
6	[3.14] gh-153030: Fix quadratic complexity in incremental parsing in … python/cpython@07efb08 GitHub	https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
7	[3.15] gh-153030: Fix quadratic complexity in incremental parsing in … python/cpython@e9f92ac GitHub	https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd

Change Log

No	Changed Details	Date of change
1	[2026年07月13日] 掲載	July 13, 2026, 11:29 a.m.