Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Published: 2026-08-23
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via uncontrolled recursion
Action: Apply patch
AI Analysis

Impact

justhtml versions before 1.10.0 contain an uncontrolled recursion flaw that can be triggered by parsing HTML with deep nesting. During construction, the parser repeatedly calls internal functions without a depth limit, causing a RecursionError when CPython's recursion limit is exceeded. This error can abort parsing, cause failed requests, or crash a worker or process depending on how the application handles the exception, effectively denying service. The vulnerability is an instance of CWE-674: Uncontrolled Recursion.

Affected Systems

The vulnerability affects EmilStenstrom's justhtml library, specifically all releases up to and including 1.9.1. The issue is fixed in justhtml 1.10.0. Applications that incorporate earlier versions of this library and accept user supplied HTML are potentially impacted.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. EPSS is not available, so the probability of exploitation is not quantified, but the flaw is in a widely used parsing routine and can be triggered by any supplied HTML. The vulnerability is not listed in CISA KEV. Attackers can feasibly exploit the issue by providing maliciously nested HTML, making it an obvious target for denial‑of‑service attacks in environments where justhtml parses untrusted content.

Generated by OpenCVE AI on August 23, 2026 at 15:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade justhtml to version 1.10.0 or later to apply the vendor fix.
  • If an upgrade is not immediately possible, implement input validation to restrict the maximum depth or size of nested elements before passing data to JustHTML().
  • Add exception handling around JustHTML() construction to catch RecursionError and gracefully return an error response instead of crashing the application.

Generated by OpenCVE AI on August 23, 2026 at 15:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-v7cf-c9rm-wm3j Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
History

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 23 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Emilstenstrom
Emilstenstrom justhtml
Vendors & Products Emilstenstrom
Emilstenstrom justhtml

Sun, 23 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Title justhtml before 1.10.0 Denial of Service via deeply nested HTML
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Emilstenstrom Justhtml
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-24T17:54:01.074Z

Reserved: 2026-05-27T20:38:38.588Z

Link: CVE-2026-9769

cve-icon Vulnrichment

Updated: 2026-08-24T17:53:54.951Z

cve-icon NVD

Status : Deferred

Published: 2026-08-23T14:16:55.277

Modified: 2026-08-26T17:10:53.700

Link: CVE-2026-9769

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-23T16:46:52Z

Weaknesses