CVE-2026-9769: justhtml before 1.10.0 Denial of Service via deeply nested HTML
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls populateselectedcontent(), which recursively traverses the DOM tree via findelements()/findelement() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.10.0
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Applications using justhtml through 1.9.1 are exposed if they parse HTML that an attacker can supply. The attacker does not need privileges or user interaction; network-reachable applications are affected when attacker-controlled HTML reaches JustHTML() construction.
What does an attacker need to send to trigger the issue?
The attacker needs to provide deeply nested HTML elements for parsing. Around 1,000 nested div elements, approximately 11 KB of HTML, can exceed CPython's default recursion limit and cause an unhandled RecursionError.
Are all affected parsing deployments equally impacted?
The parsing failure occurs when construction reaches TreeBuilder.finish() and recursively traverses the DOM without a depth bound. The resulting operational impact depends on the host application's exception handling: parsing may fail, requests may fail, or a worker or process may terminate.
What should be done if updating is not immediately possible?
Ensure untrusted HTML cannot reach the affected parser, or enforce a maximum nesting depth before parsing. The vulnerable behavior is fixed in justhtml 1.10.0.