ETK-2026-2535Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2535",
  "cve_id": null,
  "display_id": "ETK-2026-2535",
  "ghsa_id": "GHSA-f9gg-xhpx-r5qc",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic parsing denial of service in turbohtml",
  "summary": "turbohtml versions before 1.14.0 can consume disproportionate CPU while parsing specially structured HTML documents. An unauthenticated attacker may delay or exhaust parsing workers if an application accepts and parses untrusted HTML.",
  "mitigation": "Upgrade pip package turbohtml to version 1.14.0 or later. Until upgraded, restrict untrusted HTML parsing and enforce request-size and parsing-resource limits.",
  "vendor": null,
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.3.0, <= 1.13.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.14.0"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T21:11:45+00:00",
      "days": -13.21062056324074,
      "is_lower_bound": true,
      "measured_at": "2026-10-23T02:15:02.656421+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-f9gg-xhpx-r5qc"
    }
  }
}