CVE-2026-15308: python before 3.10.21 (exclusive), from 3.11.0 (inclusive), before 3.11.16 (exclusive), from 3.12.0 (inclusive)…

Affected technology

python · before 3.10.21 (exclusive)
python

python · from 3.11.0 (inclusive), before 3.11.16 (exclusive)
python

python · from 3.12.0 (inclusive), before 3.12.14 (exclusive)
python

python · from 3.13.0 (inclusive), before 3.13.15 (exclusive)
python

python · from 3.14.0 (inclusive), before 3.14.7 (exclusive)
python

python · 3.15.0 · update alpha1
python

python · 3.15.0 · update alpha2
python

python · 3.15.0 · update alpha3
python

python · 3.15.0 · update alpha4
python

python · 3.15.0 · update alpha5
python

python · 3.15.0 · update alpha6
python

python · 3.15.0 · update alpha7
python

python · 3.15.0 · update alpha8
python

python · 3.15.0 · update beta1
python

python · 3.15.0 · update beta2
python

python · 3.15.0 · update beta3
python

CPython · 0 to before 3.10.21, 3.11.0 to before 3.11.16, 3.12.0 to before 3.12.14, 3.13.0 to before 3.13.15, 3.14.0 to before 3.14.7, 3.15.0a1 to before 3.15.0b4
Python Software Foundation

Component: html.parser, html

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.