The CPython incremental HTML parser can be fed repeated unterminated markup declarations, causing unchecked loops that consume CPU resources and lead to denial of service. This flaw is identified as uncontrolled resource consumption (CWE‑400) and uncontrolled loop (CWE‑835).

The affected vendor is the Python Software Foundation, product CPython. All releases that include the standard html.parser module and process untrusted or user‑supplied markup may be vulnerable, as the CVE data does not list specific versions.

The CVSS score of 8.7 classifies the flaw as high‑severity, indicating a significant impact on availability. While the EPSS score is below 1 % and the vulnerability is not in CISA’s KEV catalog, the attack can be triggered from any application that uses CPython’s HTMLParser to process malformed markup. No special permissions are required; the exploit merely entails feeding the parser a long string of unterminated declarations to keep the interpreter busy.