ETK-2026-2534Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2534",
  "cve_id": null,
  "display_id": "ETK-2026-2534",
  "ghsa_id": "GHSA-jrmx-5874-9prq",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "awaiting_cve",
  "title": "Denial of service in turbohtml HTML tree builder",
  "summary": "turbohtml versions with the HTML parser before 1.14.0 are affected when an application parses untrusted HTML. An unauthenticated attacker can cause excessive memory consumption or crash the process by submitting specially structured HTML to a parser-backed entry point.",
  "mitigation": "Upgrade turbohtml to version 1.14.0 or later. Until upgrading, reject HTML containing `<selectedcontent>` before it reaches turbohtml's parser.",
  "vendor": null,
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.3.0, <= 1.13.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.14.0"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T21:11:48+00:00",
      "days": -13.210585867523148,
      "is_lower_bound": true,
      "measured_at": "2026-10-23T02:15:02.658010+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-jrmx-5874-9prq"
    }
  }
}