diff --git a/Lib/_markupbase.py b/Lib/_markupbase.py
index 614f0cd16ddb44..c46f24520c3636 100644
--- a/Lib/_markupbase.py
+++ b/Lib/_markupbase.py
@@ -9,7 +9,7 @@
 
 _declname_match = re.compile(r'[a-zA-Z][-_.a-zA-Z0-9]*\s*').match
 _declstringlit_match = re.compile(r'(\'[^\']*\'|"[^"]*")\s*').match
-_commentclose = re.compile(r'--\s*>')
+_commentclose = re.compile(r'--!?>')
 _markedsectionclose = re.compile(r']\s*]\s*>')
 
 # An analysis of the MS-Word extensions is available at
@@ -81,7 +81,7 @@ def parse_declaration(self, i):
         # A simple, practical version could look like: ((name|stringlit) S*) + '>'
         n = len(rawdata)
         if rawdata[j:j+2] == '--': #comment
-            # Locate --.*-- as the body of the comment
+            # Locate the body of the comment.
             return self.parse_comment(i)
         elif rawdata[j] == '[': #marked section
             # Locate [statusWord [...arbitrary SGML...]] as the body of the marked section
@@ -161,13 +161,19 @@ def parse_marked_section(self, i, report=1):
             self.unknown_decl(rawdata[i+3: j])
         return match.end(0)
 
-    # Internal -- parse comment, return length or -1 if not terminated
-    def parse_comment(self, i, report=1):
+    # Internal -- parse comment
+    # if end is True, returns EOF location if no close tag is found, otherwise
+    # return length or -1 if not terminated
+    def parse_comment(self, i, report=1, end=False):
         rawdata = self.rawdata
         if rawdata[i:i+4] != '<!--':
             raise AssertionError('unexpected call to parse_comment()')
-        match = _commentclose.search(rawdata, i+4)
+        match = _commentclose.search(rawdata, i+2)
         if not match:
+            if end:
+                if report:
+                    self.handle_comment(rawdata[i+4:])
+                return len(rawdata)
             return -1
         if report:
             j = match.start(0)
diff --git a/Lib/html/parser.py b/Lib/html/parser.py
index 13c95c34e505c8..770e5af8f6ea08 100644
--- a/Lib/html/parser.py
+++ b/Lib/html/parser.py
@@ -172,7 +172,7 @@ def goahead(self, end):
                 elif startswith("</", i):
                     k = self.parse_endtag(i)
                 elif startswith("<!--", i):
-                    k = self.parse_comment(i)
+                    k = self.parse_comment(i, end=end)
                 elif startswith("<?", i):
                     k = self.parse_pi(i)
                 elif startswith("<!", i):
diff --git a/Lib/test/test_htmlparser.py b/Lib/test/test_htmlparser.py
index b42a611c62c0aa..40266290dbf68c 100644
--- a/Lib/test/test_htmlparser.py
+++ b/Lib/test/test_htmlparser.py
@@ -324,14 +324,34 @@ def test_comments(self):
                 '<!---->'
                 '<!----I have many hyphens---->'
                 '<!-- I have a > in the middle -->'
-                '<!-- and I have -- in the middle! -->')
+                '<!-- and I have -- in the middle! -->'
+                '<!--->'
+                '<!-->'
+                '<!--<!--->'
+                '<!--And I am so-called incorrectly-closed-comment--!>'
+                '<!--!>'
+                '<!---!>'
+                '<!--I have invalid attempt to close (space) -- >-->'
+                '<!--Me too (invalid character) --x>-->'
+                '<!--Me too (invalid characters) --cheese>-->'
+                '<!--EOF comment')
         expected = [('comment', " I'm a valid comment "),
                     ('comment', 'me too!'),
                     ('comment', '--'),
                     ('comment', ''),
                     ('comment', '--I have many hyphens--'),
                     ('comment', ' I have a > in the middle '),
-                    ('comment', ' and I have -- in the middle! ')]
+                    ('comment', ' and I have -- in the middle! '),
+                    ('comment', ''),
+                    ('comment', ''),
+                    ('comment', '<!-'),
+                    ('comment', 'And I am so-called incorrectly-closed-comment'),
+                    ('comment', ''),
+                    ('comment', ''),
+                    ('comment', 'I have invalid attempt to close (space) -- >'),
+                    ('comment', 'Me too (invalid character) --x>'),
+                    ('comment', 'Me too (invalid characters) --cheese>'),
+                    ('comment', 'EOF comment')]
         self._run_check(html, expected)
 
     def test_condcoms(self):
diff --git a/Misc/NEWS.d/next/Security/2024-03-31-14-57-20.gh-issue-102555.2P8jGn.rst b/Misc/NEWS.d/next/Security/2024-03-31-14-57-20.gh-issue-102555.2P8jGn.rst
new file mode 100644
index 00000000000000..f031c37774433c
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-03-31-14-57-20.gh-issue-102555.2P8jGn.rst
@@ -0,0 +1 @@
+Follow the `parsing recommendation <https://html.spec.whatwg.org/multipage/parsing.html#parse-error-incorrectly-closed-comment>`_ and `standard <https://html.spec.whatwg.org/#comments>`_ for closing comment tag in the :mod:`html.parser`. Increased compliance leads to predictable behavior, thus enhancing security.

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<title>pFad - Phonifier reborn</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />
</head>
<body>
<h1>Pfad - The Proxy pFad of &#169; 2024 Garber Painting. All rights reserved.</h1>


<!-- Disclaimer -->
<p>Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.</p>
<br>
<p>Alternative Proxies:</p><p><a href="http://rainy.clevelandohioweatherforecast.com/php-proxy/index.php?q=https://patch-diff.githubusercontent.com/raw/python/cpython/pull/117406.diff" target="_blank">Alternative Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/index.php?u=https://patch-diff.githubusercontent.com/raw/python/cpython/pull/117406.diff" target="_blank">pFad Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v3index.php?u=https://patch-diff.githubusercontent.com/raw/python/cpython/pull/117406.diff" target="_blank">pFad v3 Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v4index.php?u=https://patch-diff.githubusercontent.com/raw/python/cpython/pull/117406.diff" target="_blank">pFad v4 Proxy</a></p></body>
</html>