The vulnerability resides in the html.parser.HTMLParser class, which exhibits worse‑case quadratic complexity when handling certain malformed inputs. Crafted data can cause the parser to consume excessive time and memory, leading to a denial‑of‑service condition. This weakness is classified as CWE-1333 and does not directly enable code execution or data exfiltration.

The affected product is CPython from the Python Software Foundation. No specific version ranges are listed in the CNA data, so the impact potentially applies to all releases that have not incorporated the fixing commits referenced in the advisory.

The CVSS score of 4.3 indicates a medium impact with limited exploitation scope. The EPSS score of less than 1% suggests a very low likelihood of current exploitation. The CVE is not listed in the CISA KEV catalog, further indicating a low urgency. Based on the description, the attack likely requires an attacker to supply crafted HTML input to a CPython process that performs parsing – a scenario that could arise in web services or content‑handling applications. No privilege escalation or remote code execution is enabled by this flaw.