The incremental HTML parser in CPython (html.parser.HTMLParser) is vulnerable to a denial-of-service condition due to repeated unterminated markup declarations. This flaw allows an attacker to cause excessive CPU consumption when parsing maliciously crafted HTML data. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption). It affects CPython versions prior to 3.16.0, including 3.15.0a1 and 3.14.0. The CVSS 4.0 base score is 8.7, indicating high severity. No known exploits are reported in the wild, and no official remediation or patch has been announced as of the publication date.

An attacker can cause a denial-of-service by triggering excessive CPU usage in the CPython HTML parser when processing specially crafted HTML input containing repeated unterminated markup declarations. This can degrade or disrupt service availability for applications using the vulnerable parser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted HTML data with the incremental HTML parser or implement application-level controls to limit exposure to untrusted input.