Re: [OE-core][scarthgap][PATCH] python3: fix CVE-2026-15308

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Jul 23, 2026 at 3:43 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> Backport the upstream CPython fix for CVE-2026-15308 to Python
> 3.12.13. The issue is a CPU denial of service in incremental
> html.parser.HTMLParser parsing, where repeated feed() calls with
> unterminated markup could repeatedly rescan and concatenate a growing
> buffer.
>
> The embedded patch is based on the Python 3.13 backport in [1]. The
> public CVE advisory is referenced in [2]. Scarthgap-specific source
> differences are recorded under Backport Changes in the embedded patch
> header.
>
> [1] https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-15308
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>

Hello,

As far as I can tell, this patch is not released on the 3.14 branch yet.
I hold it until it is applied to master (upgrade or backport) and
backported to wrynose.

Regards,
-- 
Yoann Congal
Smile ECS