CVE-2026-15308

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
Python Software FoundationCPython< 3.10.21; >= 3.11.0, < 3.11.16; >= 3.12.0, < 3.12.14; >= 3.13.0, < 3.13.15; >= 3.14.0, < 3.14.7; >= 3.15.0a1, < 3.15.0b4
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.7, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.7, < *

References

Timeline

Published
Jul 9, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-153098.8The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a CVE-2026-15318.1A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate AuCVE-2026-153102.1When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allCVE-2026-153113.5A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdowCVE-2026-153128.8The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and inCVE-2026-153147.5Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies duCVE-2026-153158.8Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker oCVE-2026-153166.5An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in TapoCVE-2026-153176.3A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of tCVE-2026-153186.3A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channelsCVE-2026-153197.3A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/midCVE-2026-15325.5A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of t