Critical Security Update for Python 3.12: CPU Denial of Service Vulnerability
Summary
ALSA-2026:39893: Important: python3.12 security update. Affects python3.12 versions < 3.12.13-3.el8_10. Fixed in 3.12.13-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data structures, and extensive libraries, making it a versatile choice for developers. However, a recently discovered vulnerability poses a significant risk, particularly in its HTML parser, which can lead to a CPU Denial of Service (DoS) under specific conditions.
Vulnerability Detail
The vulnerability identified as CVE-2026-15308 allows an attacker to exploit the HTML parser in Python 3.12 by sending repeated unterminated markup declarations. This can lead to excessive CPU usage, effectively causing a Denial of Service. The issue arises from the way the parser handles certain malformed HTML inputs, which can be crafted by an attacker to consume system resources. The ramifications of this vulnerability can be severe, especially for applications relying on Python for web services, as it can lead to service outages and degraded performance.
How To Fix
Minimum fixed version
3.12.13-3.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted HTML input with the Python HTML parser until the update is applied. Implement input validation to filter out potentially harmful markup before it reaches the parser.
Conclusion
The vulnerability in Python 3.12 poses a significant risk, particularly for applications that rely on its HTML parser. It is crucial to update to the patched version to mitigate the risk of a CPU Denial of Service. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-15308 is a vulnerability in Python 3.12's HTML parser that can lead to a CPU Denial of Service due to repeated unterminated markup declarations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to excessive CPU usage, causing Denial of Service and potentially making web applications unresponsive.
Update Python 3.12 to version 3.12.13-3.el8_10 or later using the command: 'sudo dnf update python3.12'.
Yes, avoid processing untrusted HTML input with the HTML parser until the update is applied, and implement input validation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
