Back Linuxsecurity

Fedora 43 Python 3.9 Update Fixes HTML Parser CPU Denial of Service

Linuxsecurity •LinuxSecurity Advisories • November 4, 2026

Two serious PHP flaws could let an attacker run code without logging in. See which setups and PHP versions are affected ×

Python 3.9 package for developers.

This package exists to allow developers to test their code against an older

version of Python. This is not a full Python stack and if you wish to run

your applications with Python 3.9, see other distributions

that support it, such as CentOS or RHEL or older Fedora releases.

Security fix for CVE-2026-11940 Security fix for CVE-2026-15308

* Wed Sep 23 2026 Miro Hrončok - 3.9.25-15 - Security fix for CVE-2026-11940 * Wed Sep 23 2026 Lukáš Zachar - 3.9.25-14 - Security fix for CVE-2026-15308 Resolves: rhbz#2498693 * Thu Jul 30 2026 Miro Hrončok - 3.9.25-13 - Skip UDP Lite tests if it's not supported - Fixes FTBFS on Linux kernel 7.1 and newer * Thu Jul 16 2026 Fedora Release Engineering - 3.9.25-12 - Rebuilt for

[ 1 ] Bug #2498693 - CVE-2026-15308 python3.9: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-37bcaf6ef8' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Python 3.9 Security Flaws Addressed in Fedora Updates Fedora has released security updates for Python 3.9 addressing two vulnerabilities identified as CVE-2026-11940 and CVE-2026-15308. These vulnerabilities could allow attackers to execute code without authentication, impacting users of Fedora 43, 44, and 45. The flaws were published on June 23 and July 9, 2026, respectively, with a CVSS score of 7.8 and 8.7, indicating high severity. The updates were made available on September 23, 2026, and users are advised to upgrade their installations using the 'dnf' package manager. The vulnerabilities primarily affect systems running Fedora that utilize the Python 3.9 package. Security professionals should prioritize applying these updates to mitigate potential exploitation risks. 3 sources 58

Extracted Entities

Fedora 43 Python 3.9 Update Fixes HTML Parser CPU Denial of Service

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Platforms (1)