Critical Denial of Service Vulnerability in Python 3.9: CVE-2026-15308
Summary
RLSA-2026:39798: Important: python3.9 security, bug fix, and enhancement update. Affects python3.9 versions < 0:3.9.25-7.el9_8.2. Fixed in 0:3.9.25-7.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications, including web development, data analysis, artificial intelligence, and more. This version of Python is known for its extensive libraries and frameworks, making it a popular choice among developers. However, it is susceptible to a critical vulnerability that can lead to a Denial of Service (DoS) attack through its HTML parser.
Vulnerability Detail
The vulnerability, identified as CVE-2026-15308, arises from a flaw in the HTML parser of Python 3.9. Specifically, it allows for a Denial of Service (DoS) condition when the parser encounters repeated unterminated markup declarations. This can lead to excessive CPU consumption, rendering the application unresponsive and potentially affecting the availability of services that rely on Python for processing HTML content.
How To Fix
Minimum fixed version
0:3.9.25-7.el9_8.2
This is the first release that contains the fix.
sudo dnf update python3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted HTML content until the patch is applied. This can help mitigate the risk of triggering the vulnerability while a permanent fix is being implemented.
Conclusion
The CVE-2026-15308 vulnerability in Python 3.9 presents a significant risk of Denial of Service due to flaws in the HTML parser. It is crucial for users to update to the patched version to ensure the security and availability of their applications. Temporary workarounds are available, but applying the fix is the best course of action.
See every vulnerability recorded for python3.9 →
FAQ
CVE-2026-15308 is a critical vulnerability in Python 3.9 that can lead to a Denial of Service (DoS) due to excessive CPU usage caused by the HTML parser.
If your application relies on Python 3.9 for processing HTML, it may become unresponsive under certain conditions, leading to service disruptions.
As a temporary measure, avoid processing untrusted HTML content until you can apply the patch.
More details can be found on the CVE page associated with CVE-2026-15308, which provides insights into the impact and technical aspects of the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for python3.9.
