The vulnerability identified as CVE-2026-15308 affects the incremental HTML parser component of CPython (html.parser.HTMLParser). It allows an attacker to cause a CPU denial-of-service by feeding the parser repeated unterminated markup declarations, which leads to excessive CPU consumption. This is classified under CWE-400 (Uncontrolled Resource Consumption). The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity. It affects all CPython versions before 3.16.0. As of the published date, no official fix or patch has been released by the Python Software Foundation.

Successful exploitation of this vulnerability results in a CPU denial-of-service condition, where the targeted system's CPU resources are heavily consumed by the incremental HTML parser processing malformed HTML input. This can degrade system performance or cause service outages. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted HTML data with html.parser.HTMLParser or implement external controls to limit or sanitize input to prevent repeated unterminated markup declarations.