On Thu Jul 23, 2026 at 3:43 PM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > Backport the upstream CPython fix for CVE-2026-15308 to Python > 3.12.13. The issue is a CPU denial of service in incremental > html.parser.HTMLParser parsing, where repeated feed() calls with > unterminated markup could repeatedly rescan and concatenate a growing > buffer. > > The embedded patch is based on the Python 3.13 backport in [1]. The > public CVE advisory is referenced in [2]. Scarthgap-specific source > differences are recorded under Backport Changes in the embedded patch > header. > > [1] > https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-15308 > > Signed-off-by: Deepak Rathore <[email protected]>
Hello, As far as I can tell, this patch is not released on the 3.14 branch yet. I hold it until it is applied to master (upgrade or backport) and backported to wrynose. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242101): https://lists.openembedded.org/g/openembedded-core/message/242101 Mute This Topic: https://lists.openembedded.org/mt/120410530/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
