CVE-2026-15308

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 865; of 17,787 indexed, latest versions
Container images: 896; deployed by those charts
Fix available: 17 of 18; affected packages

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Carried by container images the latest versions of 865 of 17,787 indexed charts deploy, on 896 images.

Affected package	Affected versions	Fixed in	Images
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r4	6
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r3	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.14-r2	2
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	180
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+28 more	0:3.6.8-77.el8_10, 0:3.6.8-77.el8_10.rocky.0, 3.12.14-1	136
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	85
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4	no fix listed	73
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+15 more	0:3.9.25-7.el9_8.2	55
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.13-3.el9_8.1	1

OSV records: ALPINE-CVE-2026-15308 BIT-python-2026-15308 CGA-2v5h-4pjx-m2vp CGA-7fq5-cfqp-92mf CGA-8wxj-3m53-wmwr DEBIAN-CVE-2026-15308 RHSA-2026:39320 RHSA-2026:39771 RHSA-2026:39798 RLSA-2026:39320 RLSA-2026:39798 UBUNTU-CVE-2026-15308 AZL-92271
Also known as: BIT-libpython-2026-15308, BIT-python-min-2026-15308, CGA-qq9v-hh37-fr79, CGA-vh53-c7h5-695j, CGA-xm2p-hf9g-qw3m, PSF-2026-33, RHSA-2026:50064, RHSA-2026:50065, RHSA-2026:50816, USN-8744-1

Charts affected

865 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-77.el8_10

Open the chart page →

28,605

argocd-image-updaterwenerme

1.3.1

1 of 1 See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-image-updater :v1.3.0	cb009167015c	python3@3.14.5-r0	3.14.7-r0

Open the chart page →

718

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,230

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-77.el8_10

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10

Open the chart page →

6,016

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-15308.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

896 by charts deploying them

A fixed version is listed for 17 of the 18 affected packages.

Container image	Digest	Package	Fixed in	Used by
oomk8s/readiness-check :2.0.2	875814cc853d	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	11
library/rabbitmq :3.9-management	8a279e9396a8	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	10
codeurjc/server :v1.0	310bea5b1ee7	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	8
library/rabbitmq :3.13-management :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17	8
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.2.2 :8.2.2-1-ubi9	8e01c0305844	python3.9@3.9.25-7.el9_8	0:3.9.25-7.el9_8.2	7
oomk8s/readiness-check :2.0.0	7daa08b81954	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	6
quay.io/devtron/devtron-utils :dup-chart-repo-v1.1.0	95d6f0e05636	python3.11@3.11.2-6	no fix listed	6
hyperledger/fabric-ca-tools :latest	4ce6f43ded2e	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	4
hyperledger/fabric-couchdb :0.4.15	f6c724592abf	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	4
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	4
library/rabbitmq :3.13-management-alpine :3-management-alpine	606d8c0d6b3c	python3@3.12.12-r0	3.12.14-r0	4
library/rabbitmq :3.11-management	c3f70098e01d	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	4
mastercloudapps/server :v2.23	f3d24dfe2686	python3@3.6.8-48.el8_7	0:3.6.8-77.el8_10	4
quay.io/strimzi/operator :0.37.0	52f376e64b9b	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	4
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	3
dgraph/dgraph :v21.12.0	3b55ea83fffe	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	3
library/node :lts	be23f54a88d3	python3.11@3.11.2-6+deb12u8	no fix listed	3
omecproject/cdn-video-repo :1.0.0 :remote-v3	d59ccb138ffb	python2.7@2.7.12-1ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22	3
prompve/prometheus-pve-exporter :3.10.0	4867684c0a93	python3@3.14.5-r0	3.14.7-r0	3
selenium/hub :3.141.59	02f251d48d5f	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.18	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	python3.11@3.11.2-6+deb12u6	no fix listed	3
quay.io/openshift/origin-oauth-proxy :4.14	a7dff785d821	python3@3.6.8-47.el8_6.2	0:3.6.8-77.el8_10	3
alpine/k8s :1.32.12	048f8d9c8cc7	python3@3.12.12-r0	3.14.7-r0	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	python3.12@3.12.3-1	3.12.3-1ubuntu0.17	2
cfssl/cfssl :latest :v1.6.5	c9018c2ddf0b	python3.11@3.11.2-6	no fix listed	2
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	2
confluentinc/cp-zookeeper :latest	7610a50b13e7	python3@3.6.8-69.el8_10	0:3.6.8-77.el8_10	2
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	python3@3.6.8-51.el8_8.1	0:3.6.8-77.el8_10	2
freeradius/freeradius-server :3.0.21	21c8bfa904d8	python2.7@2.7.17-1~18.04	2.7.17-1~18.04ubuntu1.13+esm15	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	python3.11@3.11.2-6	no fix listed	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	python3.13@3.13.5-2+deb13u4	no fix listed	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	python3.13@3.13.5-2+deb13u4	no fix listed	2
homebridge/homebridge :latest	77c685a40911	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	2
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	2
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10	2
istio/proxyv2 :1.10.3	a78b7a165744	python3.6@3.6.9-1~18.04ubuntu1.4	3.6.9-1~18.04ubuntu1.13+esm10	2
library/cassandra :3.11.6	5aa8400b4b3b	python2.7@2.7.17-1~18.04ubuntu1.1	2.7.17-1~18.04ubuntu1.13+esm15	2
library/cassandra :4.1.3	7cbcec0086ac	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
library/nextcloud :34.0.3 :34.0.3-apache	b97df9e0e1ee	python3.13@3.13.5-2+deb13u4	no fix listed	2
library/python :3.7	eedf63967cdb	python3.11@3.11.2-6	no fix listed	2
library/rabbitmq :4.1.0-management	935b3f84c1e4	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	2
library/rabbitmq :3.12.1-management	f020c06da226	python3.10@3.10.6-1~22.04.2ubuntu1.1	3.10.12-1~22.04.18	2
library/redmine :6.1.3-trixie	f474a901faec	python3.13@3.13.5-2+deb13u4	no fix listed	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	python3.5@3.5.2-2ubuntu0~16.04.5	3.5.2-2ubuntu0~16.04.13+esm25	2
louislam/uptime-kuma :2.5.4	917318f9d7be	python3.11@3.11.2-6+deb12u7	no fix listed	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	python3.11@3.11.2-6+deb12u6	no fix listed	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	python3.11@3.11.2-6+deb12u7	no fix listed	2
minio/operator :v4.3.7	54393e03f3b2	python3@3.6.8-41.el8	0:3.6.8-77.el8_10	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	python3.11@3.11.2-6	no fix listed	2