Loop with Unreachable Exit Condition ('Infinite Loop') SNYK-RHEL9-PYTHON3-17935064 #18683

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3 package and not the python3 package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data.

Remediation

Upgrade RHEL:9 python3 to version 0:3.9.25-7.el9_8.2 or higher.
This issue was patched in RHSA-2026:39798.

References

• https://access.redhat.com/security/cve/CVE-2026-15308
• python/cpython@07efb08
• python/cpython@7933f4b
• python/cpython@bcf98dd
• python/cpython@e9f92ac
• Another worst case quadratic complexity in HTMLParser python/cpython#153030
• gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser python/cpython#153031
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/
• http://www.openwall.com/lists/oss-security/2026/07/09/4
• python/cpython@1e7956f
• python/cpython@785df8f
• python/cpython@c2390b9