Critical Security Update for Python 3.12: CPU Denial of Service Vulnerability
Summary
ALSA-2026:39771: Important: python3.12 security update. Affects python3.12 versions < 3.12.13-3.el9_8.1. Fixed in 3.12.13-3.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries, making it a versatile tool for developers. It includes features such as modules, classes, exceptions, and dynamic data types. However, it is susceptible to security vulnerabilities, including a recent issue that can lead to a CPU Denial of Service.
Vulnerability Detail
The vulnerability identified as CVE-2026-15308 allows for a CPU Denial of Service through the HTML parser in Python 3.12. This issue arises from repeated unterminated markup declarations, which can cause the parser to enter an infinite loop, consuming excessive CPU resources and potentially leading to application downtime. The impact of this vulnerability can be severe, especially for web applications that rely on HTML parsing, as it can disrupt service availability and degrade performance.
How To Fix
Minimum fixed version
3.12.13-3.el9_8.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the HTML parser for untrusted input until the update can be applied. Implement input validation to sanitize any HTML content before processing.
Conclusion
The recent vulnerability in Python 3.12, identified as CVE-2026-15308, poses a significant risk of CPU Denial of Service. It is crucial for users to update to the patched version 3.12.13-3.el9_8.1 to mitigate this risk. Temporary workarounds can be implemented while preparing for the update.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-15308 is a vulnerability in Python 3.12 that can lead to a CPU Denial of Service due to issues in the HTML parser.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause excessive CPU usage, leading to application downtime and degraded performance, especially for web applications.
Yes, the patched version is 3.12.13-3.el9_8.1. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, implement input validation to sanitize HTML content and avoid using the HTML parser for untrusted input.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
