CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 866; of 17,787 indexed, latest versions
Container images: 897; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 866 of 17,787 indexed charts deploy, on 897 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	180
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	137
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	85
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4	no fix listed	73
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

866 by stars

Chart

Latest

Affected images

Radar Score

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,605

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,230

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

897 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	python3.8@3.8.10-0ubuntu1~20.04.7	3.8.10-0ubuntu1~20.04.18+esm7	1
atlassian/bamboo :12.1.11	4af4bb6c8d46	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
atlassian/bamboo-agent-base :12.1.11	51c2d7274eef	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
atlassian/bitbucket :10.2.7	05933f2b1cfd	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	python3.10@3.10.6-1~22.04.1	3.10.12-1~22.04.18	1
atlassian/crowd :7.2.3	c81cc7d6bc9e	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
atlassian/crowd :5.2.2	ebf761c7d437	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
atlassian/jira-software :8.14.0	37bc46cbec1a	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	1
atlassian/jira-software :11.3.11	e5548cd4eea8	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
avinash263/pyredis263 :latest	aa2b8727f1a6	python3.11@3.11.2-6	no fix listed	1
baserow/backend :1.31.1	e0b3c8130b91	python3.11@3.11.2-6+deb12u5	no fix listed	1
baserow/baserow :1.30.1	df0c42eb67e8	python3.11@3.11.2-6+deb12u4	no fix listed	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
beanbag/reviewboard :latest	6b840f546e1c	python3.10@3.10.12-1~22.04.17 python3.11@3.11.0~rc1-1~22.04.1	3.10.12-1~22.04.18 3.11.0~rc1-1~22.04.1+esm2	1
beyzkaya/blog-backend :v1.0.1	12a6a3d1c5f9	python3.11@3.11.2-6+deb12u6	no fix listed	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	python3.8@3.8.10-0ubuntu1~20.04.6	3.8.10-0ubuntu1~20.04.18+esm7	1
bitnamilegacy/cassandra :4.1.7-debian-12-r3	2b7a217999a1	python@3.11.11-0	3.10.21	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	python3.11@3.11.2-6+deb12u5	no fix listed	1
bnjbvr/kresus :0.22.1	37e216b182c8	python3.11@3.11.2-6+deb12u4	no fix listed	1
boky/postfix :5.1.0	aafc77238423	python3.13@3.13.5-2	no fix listed	1
boky/postfix :4.4.0	f3f247fd4252	python3.11@3.11.2-6+deb12u5	no fix listed	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
byjg/easy-haproxy :6.1.1	230fdb7b00ae	python3@3.14.5-r0	3.14.7-r0	1
camptocamp/mapserver :latest	bf2e8e118c9b	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	python3.11@3.11.2-6+deb12u4	no fix listed	1
castopod/castopod :1.12.10	1fd37280cbb2	python3.11@3.11.2-6+deb12u3	no fix listed	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.18	1
chetangautamm/repo :Opensips_Build	b4b94155ff5a	python3.4@3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	1
chetangautamm/repo :sipp.v3	e7f7049e1544	python3.8@3.8.5-1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
cheyang/distributed-tf :1.6.0	46cc34755493	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	python3.13@3.13.5-2	no fix listed	1
chocobozzz/peertube :v8.1.5	052712130691	python3.13@3.13.5-2+deb13u2	no fix listed	1
chriseaton/adventureworks :latest	54c3384ce701	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.18	1
citizenstig/httpbin :latest	b81c818ccb86	python3.5@3.5.2-2ubuntu0~16.04.1	3.5.2-2ubuntu0~16.04.13+esm25	1
cloudve/janis-terminal :latest	af56e77ca587	python3.6@3.6.9-1~18.04ubuntu1	3.6.9-1~18.04ubuntu1.13+esm10	1
cloudve/ttyd :latest	d79c1c5881c0	python3.6@3.6.9-1~18.04ubuntu1	3.6.9-1~18.04ubuntu1.13+esm10	1
cockroachdb/cockroach-operator :v2.1.0	983312754620	python3@3.6.8-37.el8	0:3.6.8-77.el8_10	1
codedesignplus/ms-emails-grpc :latest	e336012bc781	python3.11@3.11.2-6+deb12u8	no fix listed	1
codedesignplus/ms-emails-rest :latest	ac84661c605e	python3.11@3.11.2-6+deb12u8	no fix listed	1
coderenvs/coder-service :1.44.6	1deffc4670e6	python3@3.6.8-56.el8_9.3	0:3.6.8-77.el8_10	1
coderenvs/timescale :1.44.6	76fd37fe6830	python3@3.6.8-56.el8_9.3	0:3.6.8-77.el8_10	1
codetogether/codetogether :latest	4348c8a38752	python3.9@3.9.18-3.el9_4.3	0:3.9.25-7.el9_8.2	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	python3@3.6.8-31.el8	0:3.6.8-77.el8_10	1
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	python3@3.6.8-31.el8	0:3.6.8-77.el8_10	1
confluentinc/cp-kafka :7.1.2.amd64	3bf359d5e340	python3@3.6.8-45.el8	0:3.6.8-77.el8_10	1
confluentinc/cp-kafka :7.6.6	83dbca3efd2a	python3@3.6.8-69.el8_10	0:3.6.8-77.el8_10	1
confluentinc/cp-kafka :7.8.0-3-ubi8	adc392d28a1e	python3@3.6.8-69.el8_10	0:3.6.8-77.el8_10	1
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	python3@3.6.8-56.el8_9	0:3.6.8-77.el8_10	1