justhtml before version 1.18.0 contains multiple denial‑of‑service issues in its CSS selector handling and linkification code. The library permits applications to evaluate attacker‑controlled selector strings through methods such as query(), matches(), or selector‑based transforms, and to run selector matching over very large untrusted documents or construct DOM trees from untrusted structures. Large or complex selector inputs—including oversized selectors, long combinator chains, deeply nested functional pseudo‑classes, or cyclic DOM graphs—can cause the library to consume excessive CPU or memory. Other triggers are punctuation‑heavy or trailing-bracket linkification input. These conditions are availability‑only concerns and do not enable script execution, data disclosure, or sanitizer bypass. The default JustHTML(sanitize=True) mode is expected to be applied only by application code, so the risk is limited to scenarios where the application passes untrusted selector strings or text to the library.

Applications using EmilStenstrom’s justhtml library with a version prior to 1.18.0 are affected. The vulnerability is present in any deployment that processes untrusted selector strings or performs linkification on untrusted text using the vulnerable library.

The CVSS score of 8.7 indicates a high severity of denial of service. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploits yet. The likely attack vector is an attacker supplying a malicious or overly large selector string or linkification input to a JustHTML instance; doing so can cause disproportionate resource consumption. The vulnerability does not affect confidentiality or integrity and does not provide code execution capability.