CVE-2026-15308: Python HTML Parser CPU DoS Vulnerability – HIGH Severity

Technical summary

CVE-2026-15308 is a CPU exhaustion vulnerability in Python's html.parser.HTMLParser module. The parser's incremental processing logic fails to efficiently handle repeated unterminated markup declarations (such as unclosed '<!...>' sequences), causing pathological backtracking or inefficient state transitions that consume disproportionate CPU cycles. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating a resource-exhaustion weakness in parsing logic. The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable flaw with no privilege or user interaction requirements, though impact is limited to availability rather than confidentiality or integrity.

Business impact

Any service or application that parses untrusted HTML using Python's standard library parser becomes a denial-of-service vector. Common affected scenarios include web scrapers, content management systems, email processors, security tools that analyze HTML payloads, and any Python web framework or library that internally uses html.parser for HTML sanitization or processing. A successful attack can render the affected service unavailable, disrupting user access and potentially affecting downstream systems that depend on timely responses. Organizations running Python-based SaaS platforms, APIs, or backend services should prioritize assessment and remediation.

Affected systems

Python interpreter installations across all maintained versions that include the standard library html.parser module. The vulnerability is inherent to the parser implementation itself, making it a platform-level issue rather than a third-party package concern. Any Python application or service that processes HTML from untrusted sources is theoretically at risk. Web frameworks, libraries, and tools built on Python that rely on html.parser (rather than alternative parsers) are in scope.

Exploitability

Exploitation is straightforward and requires only the ability to submit or inject malicious HTML into a vulnerable application. No special tools, authentication, or user interaction are needed. The attack surface depends on application design: web forms accepting HTML input, email parsers, social media content processors, or API endpoints that accept HTML payloads are all viable attack vectors. The low complexity and network accessibility (CVSS AV:N/AC:L) mean this vulnerability is practical to exploit at scale if vulnerable services are internet-facing. However, widespread automated exploitation is unlikely without public proof-of-concept tools or exploitation frameworks.

Remediation

Patch Python to a version that includes the fix for html.parser.HTMLParser. Organizations should verify the exact patched version against official Python security advisories and apply updates according to their Python version and release schedule. For applications unable to immediately upgrade Python, temporary mitigations include rate-limiting or timeout enforcement on HTML parsing operations, using alternative HTML parsers (such as html5lib or lxml with libxml2), or implementing input validation to reject malformed HTML before parsing. Applications should also review their HTML processing pipeline to ensure untrusted input is validated and resource limits are enforced.

Patch guidance

Consult the official Python Security Advisory and release notes for CVE-2026-15308 to identify the patched version for your Python release series (3.8, 3.9, 3.10, 3.11, 3.12, etc.). Update using your package manager or Python installer, then verify the fix by confirming the version post-patch. Organizations with containerized deployments should rebuild container images with the patched Python version. For those running Python on embedded systems or air-gapped networks, coordinate a maintenance window to apply patches systematically. Test patch compatibility with dependent libraries before broad rollout.

Detection guidance

Monitor for abnormal CPU usage spikes correlated with HTML parsing operations in application logs. Intrusion detection systems can flag HTTP requests or API payloads containing repeated unterminated markup sequences (e.g., '<!...<!...<!...') as potential exploitation attempts. Application performance monitoring (APM) tools can alert on parsing timeout or resource exhaustion events. Log aggregation should capture any exceptions or warnings from html.parser during untrusted input processing. Network sensors can detect patterns of malicious HTML injection in request payloads, though signature-based detection may require updating once exploit patterns emerge.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (7.5), network exploitability, and the ubiquity of Python in infrastructure. The standard library nature of html.parser means the vulnerability is present in nearly all Python deployments. While not yet in the CISA KEV catalog, the combination of ease of exploitation, broad applicability, and denial-of-service impact justifies rapid assessment and patching. Organizations operating customer-facing or mission-critical Python services should prioritize this above lower-severity issues.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by network accessibility (AV:N), no privilege or user interaction requirements (PR:N/UI:N), and a high impact on availability (A:H). The score reflects that an unauthenticated attacker can remotely trigger a service outage with a single crafted request. The lack of confidentiality or integrity impact (C:N/I:N) prevents a critical rating. Organizations may adjust internal risk ratings upward if their threat model includes active DoS threats or if their application processes HTML from highly adversarial sources.

Frequently asked questions