CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 870; of 17,787 indexed, latest versions
Container images: 901; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 870 of 17,787 indexed charts deploy, on 901 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	181
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	137
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+11 more	3.12.3-1ubuntu0.17	86
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.5-2+deb13u5	no fix listed	75
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

870 by stars

Chart

Latest

Affected images

Radar Score

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.18
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

13,563

video-dl-botvideo-dl-bot

1.4.3

1 of 1 See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	python3.13@3.13.5-2+deb13u4	no fix listed

Open the chart page →

1,931

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.17

Open the chart page →

7,696

aih-scannerwallarm

2.7.11

1 of 2 See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	python3.13@3.13.5-2+deb13u4	no fix listed

Open the chart page →

3,906

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

11,167

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,225

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,699

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,857

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

8,824

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,287

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,618

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,916

Container images carrying it

901 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
sslhep/servicex_code_gen_python :v1.8.5	0e4175a4e1eb	python3.13@3.13.5-2+deb13u4	no fix listed	1
sslhep/servicex_code_gen_raw_uproot :v1.8.5	671980005c57	python3.13@3.13.5-2+deb13u4	no fix listed	1
sslhep/servicex_code_gen_topcp :v1.8.5	596db2abdd09	python3.13@3.13.5-2+deb13u4	no fix listed	1
sslhep/servicex-did-finder-atlasopenmagic :v1.8.5	54aaf1721d03	python3.13@3.13.5-2+deb13u4	no fix listed	1
sslhep/servicex-did-finder-cernopendata :v1.8.5	2cb88ceab5bb	python3.13@3.13.5-2+deb13u4	no fix listed	1
sslhep/servicex-did-finder-xrootd :v1.8.5	c284442b44e3	python3.13@3.13.5-2+deb13u4	no fix listed	1
stackstorm/st2actionrunner :3.8	88235ba70cad	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2api :3.8	6f56d239d280	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2auth :3.8	33ecfda16608	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2notifier :3.8	f190a6212195	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2rulesengine :3.8	259503496ff9	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2scheduler :3.8	b1de2055c362	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2stream :3.8	1c8904a3bf67	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stashapp/stash :latest	24dbd7607174	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
stashapp/stash :v0.31.1	df744af5a0c9	python3@3.12.13-r0	3.12.14-r0	1
statcan/ckan :2.9	3921305425b8	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
substratusai/verba :v0.4.0-baseURL2	61695be635eb	python3.11@3.11.2-6	no fix listed	1
supabase/realtime :v2.102.3	aa1c92c0cf32	python3.11@3.11.2-6+deb12u7	no fix listed	1
supabase/realtime :latest	d3aa0c86c7b3	python3.13@3.13.5-2+deb13u4	no fix listed	1
supabase/storage-api :v1.60.4	c8eb9858eafe	python3@3.12.13-r0	3.12.14-r0	1
supabase/studio :20241021-9f9b083	26d8070c55e9	python3.11@3.11.2-6+deb12u3	no fix listed	1
supabase/studio :2026.08.03-sha-022b374	606aca9fdaa7	python3.11@3.11.2-6+deb12u8	no fix listed	1
supabase/studio :latest	94a2a9d2906e	python3.11@3.11.2-6+deb12u8	no fix listed	1
svtechnmaa/svtech_debuger :v1.0.3	a934ffd63d25	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	python3.11@3.11.2-6+deb12u6	no fix listed	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	python3.11@3.11.2-6+deb12u6	no fix listed	1
szurubooru/server :2.5	accf2ad9fbc3	python3@3.12.13-r0	3.12.14-r0	1
teknas09/bird-pod :latest	12a1fa85c4aa	python3.11@3.11.2-6	no fix listed	1
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0	1
temporalio/admin-tools :1.28	cfde8170c92f	python3@3.12.12-r0	3.12.14-r0	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
theradius/loggia :0.4	63ba348546ec	python3.11@3.11.2-6	no fix listed	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	python3.13@3.13.5-2+deb13u4	no fix listed	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	python3.13@3.13.5-2+deb13u2	no fix listed	1
thongngo3301/stakefish :latest	a341af5976e3	python3.11@3.11.2-6	no fix listed	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg16	d7db8f1085a3	python3.10@3.10.12-1~22.04.17	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	python3.10@3.10.4-3	3.10.12-1~22.04.18	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	python3.13@3.13.5-2	no fix listed	1
tomsquest/docker-radicale :3.6.1.0	a594c624c5a6	python3@3.12.12-r0	3.12.14-r0	1
tpdock/freeradius :2.2.9	3da600c95a49	python2.7@2.7.12-1ubuntu0~16.04.2 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1