CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 865; of 17,787 indexed, latest versions
Container images: 896; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 865 of 17,787 indexed charts deploy, on 896 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	180
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	136
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	85
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4	no fix listed	73
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

865 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,605

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,230

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

896 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	python3.6@3.6.9-1~18.04ubuntu1.7	3.6.9-1~18.04ubuntu1.13+esm10	1
alpine/k8s :1.36.2	44ef4942e171	python3@3.14.5-r1	3.14.7-r0	1
alpine/k8s :1.31.10	6dbe6f391eda	python3@3.12.11-r0	3.12.14-r0	1
alpine/k8s :1.31.13	7a319b15cfc9	python3@3.12.11-r0	3.12.14-r0	1
alpine/k8s :1.32.4	7e1e7d5b7a96	python3@3.12.10-r0	3.12.14-r0	1
alpine/k8s :1.31.4	9c4976d47656	python3@3.12.8-r1	3.12.14-r0	1
alpine/k8s :1.35.6	b7a12c5ddf26	python3@3.14.5-r1	3.14.7-r0	1
alpine/k8s :1.35.5	d870622d0040	python3@3.14.3-r0	3.14.7-r0	1
alpine/k8s :1.32.3	eec354133193	python3@3.12.9-r0	3.12.14-r0	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
anchore/anchore-engine :v0.7.1	ed9b3badd17c	python3@3.6.8-15.1.el8	0:3.6.8-77.el8_10	1
andrcuns/dependabot-gitlab :7.7.0-alpha.1	43060f159f4c	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
andrewgolikov55/intel-gpu-exporter :latest	fcc001b61c0e	python3.10@3.10.12-1~22.04.2	3.10.12-1~22.04.18	1
andrewmackrodt/firefox-x11 :142.0.1-r1	33f9080470c9	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.18	1
andrianrf/backoffice :latest	047a7837651e	python3@3.6.8-62.el8_10	0:3.6.8-77.el8_10	1
andrianrf/backoffice-be :latest	6036614803d4	python3.9@3.9.16-1.el9	0:3.9.25-7.el9_8.2	1
andrianrf/iso-server :latest	7da47f525c7d	python3.9@3.9.16-1.el9	0:3.9.25-7.el9_8.2	1
antiantiops/vscode-browser-docker :1.137.0	eeff80a99d92	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
antrea/antrea-agent-ubuntu :v2.7.0	c10bc45c6272	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
anujdatar/cups :25.07.01	685df04a643b	python3.11@3.11.2-6+deb12u6	no fix listed	1
apache/airflow :2.8.4-python3.9	64e58748b6b9	python3.11@3.11.2-6	no fix listed	1
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	python3.11@3.11.2-6+deb12u3	no fix listed	1
apache/airflow :2.8.1	e5560ad0b86e	python3.11@3.11.2-6	no fix listed	1
apache/gravitino-iceberg-rest :1.3.0	80136ae753ee	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.18	1
apache/hertzbeat :1.8.0	75d48a62748f	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.17	1
apache/hertzbeat-collector :1.8.0	a2bab1be574c	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.17	1
apache/polaris :latest	e66366e783f1	python3.9@3.9.25-7.el9_8	0:3.9.25-7.el9_8.2	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	python3.10@3.10.12-1~22.04.2	3.10.12-1~22.04.18	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
apachepulsar/pulsar :3.0.7	9c9947de139d	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	1
apachepulsar/pulsar :2.9.0	d056c89b7131	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	1
apachepulsar/pulsar :2.8.2	d538416d5afe	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
apache/ranger :2.7.0	76c176e8a0e4	python3.10@3.10.12-1~22.04.10	3.10.12-1~22.04.18	1
apache/tika :latest-full	80072bb73dd3	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	1
apecloud/kb-cloud-installer :v2.1.42-certified	98abc64aa985	python3.9@3.9.25-2.el9_7	0:3.9.25-7.el9_8.2	1
apecloud/smartfs-csi-driver :0.1.1	ff2858eab9cc	python3@3.6.8-51.el8_8.2	0:3.6.8-77.el8_10	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	1
apicurio/apicurio-studio-ui :0.2.62.Final	349c845270c2	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	1
apicurio/apicurio-studio-ws :0.2.62.Final	27a91978a388	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	1
appwrite/appwrite :1.9.0	1aaa70127114	python3@3.12.12-r0	3.12.14-r0	1
appwrite/appwrite :1.9.6	adc7d0e7ec23	python3@3.12.13-r0	3.12.14-r0	1
archivebox/archivebox :0.7.4	1a5a37331091	python3.11@3.11.2-6+deb12u7	no fix listed	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	python3.11@3.11.2-6	no fix listed	1
arunvelsriram/utils :latest	655ad18fd8d6	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.17	1
assistiot/identity-manager_kc :latest	0df4b4fa899a	python3@3.6.8-47.el8_6	0:3.6.8-77.el8_10	1
assistiot/open_api_backend :1.1.2	30812ba93555	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	python3.11@3.11.2-6	no fix listed	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	python3.11@3.11.2-6	no fix listed	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	python3.11@3.11.2-6	no fix listed	1