CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 865; of 17,787 indexed, latest versions
Container images: 896; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 865 of 17,787 indexed charts deploy, on 896 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	180
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	136
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	85
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4	no fix listed	73
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

865 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,605

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,230

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

896 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
nacos/nacos-server :latest	1c191c30c8cd	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	2
nutanix/nai-jobs :v2.8.0	9c373718e1b1	python3.13@3.13.5-2+deb13u4	no fix listed	2
obolnetwork/charon :v1.10.0	278c7e2897b6	python3.13@3.13.5-2	no fix listed	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	2
opendatacube/ows :latest	668cbb41473c	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.17	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	python3.11@3.11.2-6	no fix listed	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
redis/redis-stack-server :7.4.0 :7.4.0-v1	72035434f455	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	2
redis/redis-stack-server :7.2.0-v10	e44b2b49d059	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
smartedge/generic-multi-access-network-virtualization :1.0	4cd63c22ce36	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	2
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	python3@3.6.8-45.el8	0:3.6.8-77.el8_10	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	python3.10@3.10.4-3	3.10.12-1~22.04.18	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.18	2
uffizzi/controller :latest	0344805f267b	python3.11@3.11.2-6	no fix listed	2
vdiogov/glpi-conteiner :latest	6945f84f0058	python3.11@3.11.2-6+deb12u2	no fix listed	2
wurstmeister/zookeeper :latest	7a7fd44a7210	python2.7@2.7.6-8 python3.4@3.4.0-2ubuntu1	2.7.6-8ubuntu0.6+esm30 3.4.3-1ubuntu1~14.04.7+esm21	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	python2.7@2.7.18-13ubuntu1.1 python3.10@3.10.6-1~22.04	2.7.18-13ubuntu1.5+esm9 3.10.12-1~22.04.18	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	python3.11@3.11.2-6+deb12u2	no fix listed	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	python2.7@2.7.17-1~18.04ubuntu1.2	2.7.17-1~18.04ubuntu1.13+esm15	2
ghcr.io/plausible/community-edition :v3.2.1	33e60bfb40f2	python3@3.12.13-r0	3.12.14-r0	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	python3.11@3.11.2-6+deb12u6	no fix listed	2
ghcr.io/xeor/karb :1.0.6 :main	647a3c938d31	python-3.14@3.14.6-r0	3.14.6-r4	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7	2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.1-1-ubi9	d20bd62f0182	python3.9@3.9.23-2.el9	0:3.9.25-7.el9_8.2	2
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0	2
quay.io/frrouting/frr :10.4.3	8745af1f9bbb	python3@3.12.12-r0	3.12.14-r0	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	python3@3.6.8-41.el8	0:3.6.8-77.el8_10	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	python3@3.6.8-39.el8_4.1	0:3.6.8-77.el8_10	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	python3@3.6.8-39.el8_4.1	0:3.6.8-77.el8_10	2
quay.io/strimzi/drain-cleaner :1.6.1	5fb28e9f30d0	python3.9@3.9.25-7.el9_8	0:3.9.25-7.el9_8.2	2
quay.io/strimzi/operator :0.39.0	02f6f143fc6d	python3@3.6.8-56.el8_9.3	0:3.6.8-77.el8_10	2
quay.io/strimzi/operator :0.46.0	ac434a48ac2b	python3.9@3.9.21-1.el9_5	0:3.9.25-7.el9_8.2	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	python3@3.12.12-r0	3.12.14-r0	2
registry.k8s.io/sig-storage/smbplugin :v1.20.3	dc7746bb081e	python3.11@3.11.2-6+deb12u7	no fix listed	2
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	python3.6@3.6.9-1~18.04ubuntu1	3.6.9-1~18.04ubuntu1.13+esm10	1
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	python3.13@3.13.5-2+deb13u2	no fix listed	1
aboogie/login_test_backend :new	9c41a4483ac8	python3.11@3.11.2-6+deb12u2	no fix listed	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	python3.8@3.8.5-1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
aerospike/aerospike-graph-service :3.3.0	f35739b97a46	python3@3.14.5-r0	3.14.7-r0	1
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	python3.11@3.11.2-6+deb12u8	no fix listed	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
akeyless/base :latest	759e4289fae8	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.17	1
akeyless/base-rhel :0.0.1	4ba8900a0061	python3@3.6.8-56.el8_9.3	0:3.6.8-77.el8_10	1
akeyless/gateway :5.3.1	3d2e7dce5eb9	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
aktosecurity/mirror-api-logging :k8s_ebpf	fcf8be10bead	python3@3.12.13-r0	3.12.14-r0	1
allegroai/clearml :2.0.0-613	713ae38f7daf	python3.11@3.11.2-6+deb12u4	no fix listed	1