CVE-2026-9769 - justhtml before 1.10.0 Denial of Service via deeply nested HTML
Brief
CVE ID : CVE-2026-9769
Published : Aug. 23, 2026, 2:16 p. m.
- 2 hours, 54 minutes ago
Description : justhtml through 1.
- 1 (fixed in 1.
- 0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder. finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e. g.
, ~1000 nested tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Severity: 7.5
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...