Critical Security Update for Python 3.12: CPU Denial of Service Vulnerability
Summary
ALSA-2026:39183: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.13-2.el10_2.1. Fixed in 3.12.13-2.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports multiple programming paradigms and is equipped with extensive libraries and frameworks. The affected package, Python 3.12, includes various modules and functionalities that are essential for application development. However, it has been identified that the HTML parser in Python 3.12 is susceptible to a CPU Denial of Service attack due to repeated unterminated markup declarations, which can lead to performance degradation and application unavailability.
Vulnerability Detail
The vulnerability, identified as CVE-2026-15308, arises from a flaw in the HTML parser of Python 3.12. This flaw allows an attacker to craft specific input that causes the parser to enter an infinite loop or consume excessive CPU resources, leading to a Denial of Service condition. The ramifications of this vulnerability can be severe, as it can render applications that rely on the affected Python version unresponsive, impacting user experience and service availability. It is crucial for developers and system administrators to address this vulnerability promptly to maintain application integrity and performance.
How To Fix
Minimum fixed version
3.12.13-2.el10_2.1
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input to the HTML parser to avoid triggering the vulnerability. However, this is not a permanent solution and updating to the patched version is strongly advised.
Conclusion
The identified vulnerability in Python 3.12 poses a significant risk of CPU Denial of Service attacks, necessitating immediate attention from developers and system administrators. By updating to the patched version, users can safeguard their applications against potential disruptions. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2026-15308 is a security vulnerability in Python 3.12 that allows for a CPU Denial of Service attack via the HTML parser.
This vulnerability can lead to excessive CPU usage, causing your application to become unresponsive and impacting user experience.
If an immediate update is not possible, consider implementing input validation to limit the data processed by the HTML parser as a temporary measure.
More details can be found on the CVE page for CVE-2026-15308, which outlines the impact and technical specifics of the vulnerability.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, ensuring real-time protection.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
