justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

Problem type

Uncontrolled Recursion

Affected products

EmilStenstrom

justhtml

< 1.10.0 - AFFECTED

1.10.0 - UNAFFECTED

References

GitHub Security Advisory (GHSA-v7cf-c9rm-wm3j)

https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j

vendor-advisory

VulnCheck Advisory: justhtml before 1.10.0 Denial of Service via deeply nested HTML

https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html

third-party-advisory

GitHub Security Advisories

GHSA-892m-gcq8-2468

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to...

https://github.com/advisories/GHSA-892m-gcq8-2468

tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

github.com

https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-9769

vulncheck.com

https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html

github.com

https://github.com/advisories/GHSA-892m-gcq8-2468

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-9769

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-9769",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-08-23T13:34:15.503Z",
    "dateReserved": "2026-05-27T20:38:38.588Z",
    "datePublished": "2026-08-23T13:34:15.503Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-08-23T13:34:15.503Z"
      },
      "datePublic": "2026-03-15T00:00:00.000Z",
      "title": "justhtml before 1.10.0 Denial of Service via deeply nested HTML",
      "descriptions": [
        {
          "lang": "en",
          "value": "justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling."
        }
      ],
      "affected": [
        {
          "vendor": "EmilStenstrom",
          "product": "justhtml",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "1.10.0"
            },
            {
              "version": "1.10.0",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Uncontrolled Recursion",
              "cweId": "CWE-674",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j",
          "name": "GitHub Security Advisory (GHSA-v7cf-c9rm-wm3j)",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html",
          "name": "VulnCheck Advisory: justhtml before 1.10.0 Denial of Service via deeply nested HTML",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "kq5y",
          "type": "reporter"
        }
      ]
    }
  }
}