Read the docs
TI-2026-12884 Aliases CVE-2026-15308GHSA-7qj2-q5c8-cxx5

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Priority MEDIUM 45CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 39 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00637 50th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.10.21, 3.11.16, 3.12.14 +3Red Hat: 88 advisoriesRed Hat: 39 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7; 3.15.0a1 to before 3.15.0b43.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7; 3.15.0a1 to before 3.15.0b4 Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*3.15.0 alpha1Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*3.15.0 alpha2Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*3.15.0 alpha3Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*3.15.0 alpha4Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*3.15.0 alpha5Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*3.15.0 alpha6Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*3.15.0 alpha7Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*3.15.0 alpha8Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*3.15.0 beta1Vulnerablepython-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* Versions 3.15.0 alpha1 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:* Versions 3.15.0 alpha2 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:* Versions 3.15.0 alpha3 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* Versions 3.15.0 alpha4 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:* Versions 3.15.0 alpha5 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:* Versions 3.15.0 alpha6 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:* Versions 3.15.0 alpha7 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:* Versions 3.15.0 alpha8 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:* Versions 3.15.0 beta1 Vulnerable ·python-pillow
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:*3.15.0 beta2Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:*3.15.0 beta3Vulnerablepython-pillow
  • cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:* Versions 3.15.0 beta2 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:* Versions 3.15.0 beta3 Vulnerable ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4

Red Hat 88 advisories

  • RHSA-2026:81171 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:81170 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:81169 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
Show 85 more Red Hat advisories
  • RHSA-2026:81168 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:81162 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:81161 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:81128 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:81127 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:81126 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.0.5 (CPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:81124 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.0.5 (TPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:80860 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80858 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:80856 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:80795 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.0.5 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80787 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:80781 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:80780 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.0.5 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:80776 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:80770 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:80771 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:80768 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:80769 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:80763 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80761 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:80760 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80759 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.4.4 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:80757 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80755 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.0.5 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80756 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:80754 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:80742 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:80739 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:80740 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80738 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:80737 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80735 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:80732 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:76945 Released 2026-10-06 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-unversioned-command-3.9.16-1.el9_2.15, python3-devel-3.9.16-1.el9_2.15, python3-tkinter-3.9.16-1.el9_2.15
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python3-3.9.16-1.el9_2.15, python3-libs-3.9.16-1.el9_2.15, python3.9-3.9.16-1.el9_2.15
  • RHSA-2026:76042 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:75659 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:75657 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:75655 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:75654 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74771 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74688 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74687 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:74685 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74683 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74681 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74679 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74678 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74677 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74088 Released 2026-09-30 · Red Hat rating Important
    python3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3-3.9.21-2.el9_6.7, python3-debug-3.9.21-2.el9_6.7, python3-idle-3.9.21-2.el9_6.7 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-unversioned-command-3.9.21-2.el9_6.7, python3-devel-3.9.21-2.el9_6.7, python3-tkinter-3.9.21-2.el9_6.7
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python3-3.9.21-2.el9_6.7, python3-libs-3.9.21-2.el9_6.7, python3.9-3.9.21-2.el9_6.7
  • RHSA-2026:74087 Released 2026-09-30 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) python-unversioned-command-3.9.18-3.el9_4.14, python3-devel-3.9.18-3.el9_4.14, python3-tkinter-3.9.18-3.el9_4.14
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) python3-3.9.18-3.el9_4.14, python3-libs-3.9.18-3.el9_4.14, python3.9-3.9.18-3.el9_4.14
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:54554 Released 2026-08-13 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.13-3.13.15-1.hum1@aarch64, python3.13-3.13.15-1.hum1@src, python3.13-3.13.15-1.hum1@x86_64 +16
  • RHSA-2026:54534 Released 2026-08-13 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python-unversioned-command-3.14.7-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.7-1.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.7-1.hum1@aarch64 +28
  • RHSA-2026:50816 Released 2026-08-05 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.12, platform-python-debug-3.6.8-39.el8_4.12, platform-python-devel-3.6.8-39.el8_4.12 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.12, platform-python-debug-3.6.8-39.el8_4.12, platform-python-devel-3.6.8-39.el8_4.12 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.12, python3-3.6.8-39.el8_4.12, python3-libs-3.6.8-39.el8_4.12 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.12, python3-3.6.8-39.el8_4.12, python3-libs-3.6.8-39.el8_4.12 +1
  • RHSA-2026:50770 Released 2026-08-05 · Red Hat rating Important
    python3.12 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3.12-3.12.9-1.el9_6.9, python3.12-debug-3.12.9-1.el9_6.9, python3.12-idle-3.12.9-1.el9_6.9 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-3.12.9-1.el9_6.9, python3.12-devel-3.12.9-1.el9_6.9, python3.12-libs-3.12.9-1.el9_6.9 +1
  • RHSA-2026:50771 Released 2026-08-05 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) python3.12-3.12.1-4.el9_4.14, python3.12-devel-3.12.1-4.el9_4.14, python3.12-libs-3.12.1-4.el9_4.14 +1
  • RHSA-2026:50064 Released 2026-08-04 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) platform-python-3.6.8-51.el8_8.16, platform-python-debug-3.6.8-51.el8_8.16, platform-python-devel-3.6.8-51.el8_8.16 +3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) platform-python-3.6.8-51.el8_8.16, platform-python-debug-3.6.8-51.el8_8.16, platform-python-devel-3.6.8-51.el8_8.16 +3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) platform-python-3.6.8-51.el8_8.16, python3-3.6.8-51.el8_8.16, python3-libs-3.6.8-51.el8_8.16 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) platform-python-3.6.8-51.el8_8.16, python3-3.6.8-51.el8_8.16, python3-libs-3.6.8-51.el8_8.16 +1
  • RHSA-2026:50065 Released 2026-08-04 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.14, platform-python-debug-3.6.8-47.el8_6.14, platform-python-devel-3.6.8-47.el8_6.14 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.14, platform-python-debug-3.6.8-47.el8_6.14, platform-python-devel-3.6.8-47.el8_6.14 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.14, python3-3.6.8-47.el8_6.14, python3-libs-3.6.8-47.el8_6.14 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.14, python3-3.6.8-47.el8_6.14, python3-libs-3.6.8-47.el8_6.14 +1
  • RHSA-2026:47939 Released 2026-07-29 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-unversioned-command-3.12.9-2.el10_0.10, python3-devel-3.12.9-2.el10_0.10, python3-tkinter-3.12.9-2.el10_0.10
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python3-3.12.9-2.el10_0.10, python3-libs-3.12.9-2.el10_0.10, python3.12-3.12.9-2.el10_0.10
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python3-debug-3.12.9-2.el10_0.10, python3-idle-3.12.9-2.el10_0.10, python3-test-3.12.9-2.el10_0.10
  • RHSA-2026:46836 Released 2026-07-27 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:41949 Released 2026-07-20 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-3.14.5-1.el9_8.1, python3.14-devel-3.14.5-1.el9_8.1, python3.14-libs-3.14.5-1.el9_8.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14-3.14.5-1.el9_8.1, python3.14-debug-3.14.5-1.el9_8.1, python3.14-freethreading-3.14.5-1.el9_8.1 +9
  • RHSA-2026:40856 Released 2026-07-16 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-3.14.5-1.el10_2.1, python3.14-devel-3.14.5-1.el10_2.1, python3.14-libs-3.14.5-1.el10_2.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3.14-debug-3.14.5-1.el10_2.1, python3.14-freethreading-3.14.5-1.el10_2.1, python3.14-freethreading-debug-3.14.5-1.el10_2.1 +7
  • RHSA-2026:39893 Released 2026-07-15 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.13-3.el8_10, python3.12-devel-3.12.13-3.el8_10, python3.12-libs-3.12.13-3.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.13-3.el8_10, python3.12-debug-3.12.13-3.el8_10, python3.12-idle-3.12.13-3.el8_10 +2
  • RHSA-2026:39798 Released 2026-07-15 · Red Hat rating Important
    python3.9 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-7.el9_8.2, python3-devel-3.9.25-7.el9_8.2, python3-tkinter-3.9.25-7.el9_8.2
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-7.el9_8.2, python3-libs-3.9.25-7.el9_8.2, python3.9-3.9.25-7.el9_8.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-7.el9_8.2, python3-debug-3.9.25-7.el9_8.2, python3-idle-3.9.25-7.el9_8.2 +2
  • RHSA-2026:39771 Released 2026-07-15 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.13-3.el9_8.1, python3.12-devel-3.12.13-3.el9_8.1, python3.12-libs-3.12.13-3.el9_8.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.13-3.el9_8.1, python3.12-debug-3.12.13-3.el9_8.1, python3.12-idle-3.12.13-3.el9_8.1 +2
  • RHSA-2026:39320 Released 2026-07-14 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-77.el8_10, platform-python-debug-3.6.8-77.el8_10, platform-python-devel-3.6.8-77.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-77.el8_10, python3-3.6.8-77.el8_10, python3-libs-3.6.8-77.el8_10 +1
  • RHSA-2026:39183 Released 2026-07-14 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.13-2.el10_2.1, python3-devel-3.12.13-2.el10_2.1, python3-tkinter-3.12.13-2.el10_2.1
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.13-2.el10_2.1, python3-libs-3.12.13-2.el10_2.1, python3.12-3.12.13-2.el10_2.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.13-2.el10_2.1, python3-idle-3.12.13-2.el10_2.1, python3-test-3.12.13-2.el10_2.1
  • RHSA-2026:38018 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.11-3.11.15-5.2.hum1@aarch64, python3.11-3.11.15-5.2.hum1@src, python3.11-3.11.15-5.2.hum1@x86_64 +12
  • RHSA-2026:38017 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.12-3.12.13-3.5.hum1@aarch64, python3.12-3.12.13-3.5.hum1@src, python3.12-3.12.13-3.5.hum1@x86_64 +12
  • RHSA-2026:37535 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.13-3.13.14-1.3.hum1@aarch64, python3.13-3.13.14-1.3.hum1@src, python3.13-3.13.14-1.3.hum1@x86_64 +16
  • RHSA-2026:37533 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.14-3.14.6-1.3.hum1@aarch64, python3.14-3.14.6-1.3.hum1@src, python3.14-3.14.6-1.3.hum1@x86_64 +26

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:50770, RHSA-2026:74088
Red Hat Discovery 2Fixed RHSA-2026:46836
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:39183, RHSA-2026:40856
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:39320, RHSA-2026:39893
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:39771, RHSA-2026:39798, RHSA-2026:41949
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:50816
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:50065
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:50064
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:76945
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:50771, RHSA-2026:74087
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:47939
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:50770, RHSA-2026:74088
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:50816
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:50065
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:50064
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:39183
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:39320
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:39798
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:50816
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:50065
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:50064
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:76945
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:74087
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:47939
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:74088
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:50816
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:50065
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:50064
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:39893
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:39183, RHSA-2026:40856
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:39771, RHSA-2026:39798, RHSA-2026:41949
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:47939
Red Hat Hardened ImagesFixed RHSA-2026:37533, RHSA-2026:37535, RHSA-2026:38017, RHSA-2026:38018, RHSA-2026:54534, RHSA-2026:54554
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962, RHSA-2026:80755, RHSA-2026:80780, RHSA-2026:80795, RHSA-2026:81124, RHSA-2026:81126
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463, RHSA-2026:80735, RHSA-2026:80739, RHSA-2026:80740, RHSA-2026:80757, RHSA-2026:80760, RHSA-2026:81128
Red Hat OpenShift AI 3.3Fixed RHSA-2026:80732, RHSA-2026:80737, RHSA-2026:80738, RHSA-2026:80742, RHSA-2026:80754, RHSA-2026:80756, RHSA-2026:80761, RHSA-2026:81127
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674, RHSA-2026:74677, RHSA-2026:74678, RHSA-2026:74679, RHSA-2026:74681, RHSA-2026:74683, RHSA-2026:74685, RHSA-2026:74687, RHSA-2026:74688, RHSA-2026:80759, RHSA-2026:80763, RHSA-2026:80768, RHSA-2026:80769, RHSA-2026:80770, RHSA-2026:80771, RHSA-2026:80776, RHSA-2026:80781, RHSA-2026:80787
Red Hat OpenShift AI 3.5Fixed RHSA-2026:74771, RHSA-2026:75654, RHSA-2026:75655, RHSA-2026:75657, RHSA-2026:75659, RHSA-2026:76042, RHSA-2026:80856, RHSA-2026:80858, RHSA-2026:80860, RHSA-2026:81161, RHSA-2026:81162, RHSA-2026:81168, RHSA-2026:81169, RHSA-2026:81170, RHSA-2026:81171
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Virtualization 4
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15308
  2. 2026-10-03 Alias added: GHSA-7qj2-q5c8-cxx5
  3. 2026-10-05 Fix available: RHSA-2026:75659 · Red Hat
  4. 2026-10-05 Fix available: RHSA-2026:75655 · Red Hat
  5. 2026-10-05 Fix available: RHSA-2026:75657 · Red Hat
  6. 2026-10-05 Fix available: RHSA-2026:75654 · Red Hat
  7. 2026-10-05 Affected versions changed · Red Hat
  8. 2026-10-06 Fix available: RHSA-2026:76042 · Red Hat
  9. 2026-10-06 Affected versions changed · Red Hat
  10. 2026-10-07 Fix available: RHSA-2026:76945 · Red Hat
  11. 2026-10-07 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · Red Hat
  12. 2026-10-13 Fix available: RHSA-2026:80735 · Red Hat
  13. 2026-10-13 Fix available: RHSA-2026:80732 · Red Hat
  14. 2026-10-13 Fix available: RHSA-2026:80739 · Red Hat
  15. 2026-10-13 Fix available: RHSA-2026:80737 · Red Hat
  16. 2026-10-13 Fix available: RHSA-2026:80742 · Red Hat
  17. 2026-10-13 Fix available: RHSA-2026:80755 · Red Hat
  18. 2026-10-13 Fix available: RHSA-2026:80754 · Red Hat
  19. 2026-10-13 Fix available: RHSA-2026:80740 · Red Hat
  20. 2026-10-13 Fix available: RHSA-2026:80738 · Red Hat
  21. 2026-10-13 Fix available: RHSA-2026:80757 · Red Hat
  22. 2026-10-13 Fix available: RHSA-2026:80756 · Red Hat
  23. 2026-10-13 Fix available: RHSA-2026:80763 · Red Hat
  24. 2026-10-13 Fix available: RHSA-2026:80761 · Red Hat
  25. 2026-10-13 Fix available: RHSA-2026:80768 · Red Hat
  26. 2026-10-13 Fix available: RHSA-2026:80769 · Red Hat
  27. 2026-10-13 Fix available: RHSA-2026:80771 · Red Hat
  28. 2026-10-13 Fix available: RHSA-2026:80770 · Red Hat
  29. 2026-10-13 Fix available: RHSA-2026:80781 · Red Hat
  30. 2026-10-13 Fix available: RHSA-2026:80780 · Red Hat
  31. 2026-10-13 Fix available: RHSA-2026:80759 · Red Hat
  32. 2026-10-13 Fix available: RHSA-2026:80760 · Red Hat
  33. 2026-10-13 Fix available: RHSA-2026:80787 · Red Hat
  34. 2026-10-13 Fix available: RHSA-2026:80776 · Red Hat
  35. 2026-10-13 Fix available: RHSA-2026:80795 · Red Hat
  36. 2026-10-13 Fix available: RHSA-2026:80856 · Red Hat
  37. 2026-10-13 Fix available: RHSA-2026:80860 · Red Hat
  38. 2026-10-13 Fix available: RHSA-2026:80858 · Red Hat
  39. 2026-10-13 Fix available: RHSA-2026:81127 · Red Hat
  40. 2026-10-13 Fix available: RHSA-2026:81124 · Red Hat
  41. 2026-10-13 Fix available: RHSA-2026:81126 · Red Hat
  42. 2026-10-13 Fix available: RHSA-2026:81128 · Red Hat
  43. 2026-10-13 Fix available: RHSA-2026:81161 · Red Hat
  44. 2026-10-13 Fix available: RHSA-2026:81162 · Red Hat
  45. 2026-10-13 Fix available: RHSA-2026:81169 · Red Hat
  46. 2026-10-13 Fix available: RHSA-2026:81168 · Red Hat
  47. 2026-10-13 Fix available: RHSA-2026:81171 · Red Hat
  48. 2026-10-13 Fix available: RHSA-2026:81170 · Red Hat
  49. 2026-10-13 Fix available: Red Hat OpenShift AI 3.3 · Red Hat
  50. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 9

Advisory 2

  • TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences