CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 863; of 17,790 indexed, latest versions
Container images: 893; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 863 of 17,790 indexed charts deploy, on 893 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	179
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	137
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+11 more	3.12.3-1ubuntu0.17	82
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	74
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.5-2+deb13u5	no fix listed	74
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

863 by stars

Chart

Latest

Affected images

Radar Score

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,699

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,857

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

8,824

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,287

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,618

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,916

Container images carrying it

893 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/apicurio/apicurio-registry-mem :2.5.8.Final	3b036692d546	python3@3.6.8-56.el8_9	0:3.6.8-77.el8_10	1
quay.io/argoprojlabs/argocd-image-updater :v1.2.1	3c56f354fac5	python3@3.12.13-r0	3.12.14-r0	1
quay.io/argoprojlabs/gitops-promoter :v0.38.1	9c8a510dc25e	python3.13@3.13.5-2+deb13u4	no fix listed	1
quay.io/backube/volsync :0.16.0	0d03a6aad575	python3.9@3.9.25-7.el9_8	0:3.9.25-7.el9_8.2	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	1
quay.io/ctrontesting/iofog-controller :latest	10df27bc5560	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
quay.io/everythingascode/apishift :v0.3.0	8fbbcd23b902	python3.9@3.9.25-7.el9_8	0:3.9.25-7.el9_8.2	1
quay.io/everythingascode/apishift-backend :v0.3.0	14ff275b2e61	python3.9@3.9.21-1.el9_5	0:3.9.25-7.el9_8.2	1
quay.io/evryfs/docker-mcrouter :0.40.0-9	a2d3a4c67b0f	python3.6@3.6.9-1~18.04ubuntu1.8	3.6.9-1~18.04ubuntu1.13+esm10	1
quay.io/fengyuanxing/zte_endogenous_security/kite-agent :V2.0.0	734808044936	python3@3.6.8-76.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/apollo :0.0.10	55330b1b60c1	python3@3.6.8-45.el8	0:3.6.8-77.el8_10	1
quay.io/fiware/canis-major :1.5.15	bb40472e4ff5	python3@3.6.8-41.el8	0:3.6.8-77.el8_10	1
quay.io/fiware/contract-management :3.3.12	2bcfcf874451	python3@3.6.8-67.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/credentials-config-service :3.4.3	f2fbced76da8	python3@3.6.8-67.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/endpoint-configuration-service :0.4.3	0dc38a87b844	python3@3.6.8-45.el8	0:3.6.8-77.el8_10	1
quay.io/fiware/orion-ld :1.10.0	b7ee7569a9a8	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	python3@3.6.8-39.el8_4	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-account :1.18.0	6b25aac03414	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-agreement :1.18.0	81e7025dc16d	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-customer-bill-management :1.18.0	dee901f1f75d	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-customer-management :1.18.0	d3519cebecd0	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-party-catalog :1.18.0	7d6969a7393a	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-party-role :1.18.0	52db89f17863	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-product-catalog :1.18.0	e409338726da	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-product-inventory :1.18.0	3a5d6dd30f1d	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-product-ordering-management :1.18.0	42c81c291f6f	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-quote :1.18.0	d9ca3a334352	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-resource-catalog :1.18.0	b0d853627c59	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-resource-function-activation :1.18.0	62a5acb63fd1	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-resource-inventory :1.18.0	553b4a47730b	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-resource-order-management :1.18.0	dd1778ad6203	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-service-catalog :1.18.0	74b0fad9e155	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-service-inventory :1.18.0	4be54e8cb5c0	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-service-order-management :1.18.0	d2091785d544	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-software-management :1.18.0	1b74a2f7ba67	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/tmforum-usage-management :1.18.0	42f190c42926	python3@3.6.8-70.el8_10	0:3.6.8-77.el8_10	1
quay.io/fiware/trusted-issuers-list :0.9.1	3c886ce5c056	python3.9@3.9.21-2.el9_6.1	0:3.9.25-7.el9_8.2	1
quay.io/fiware/trusted-issuers-registry :0.11.1	a8a9ec461034	python3@3.6.8-45.el8	0:3.6.8-77.el8_10	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1
quay.io/flomesh/pipy-repo-ubi8 :0.70.0-46	9912fdf6c183	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1
quay.io/galexrt/dellhw_exporter :v2.0.0-rc.1	8a1361fa38c1	python3.9@3.9.18-3.el9_4.5	0:3.9.25-7.el9_8.2	1
quay.io/galexrt/dellhw_exporter :v2.0.0	b3a5806d73b5	python3.9@3.9.25-3.el9_7.1	0:3.9.25-7.el9_8.2	1
quay.io/hpestorage/filex-csi-driver :2.6.4	b7f960bbf472	python3.9@3.9.23-2.el9	0:3.9.25-7.el9_8.2	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	python3@3.6.8-23.el8	0:3.6.8-77.el8_10	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	1