Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-4671: justhtml Denial-of-Service Vulnerability in CSS and Linkification
CVE-2026-4671 · published 11 days ago
Summary
justhtml versions prior to 1.18.0 are vulnerable to denial-of-service attacks when processing CSS selectors and links. This could cause a website to consume excessive CPU or memory, making it unavailable to users. Update to version 1.18.0 to fix this issue.
What to do
- Update justhtml to version 1.18.0.
- Update emilstenstrom justhtml to version 1.18.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | emilstenstrom | justhtml | < 1.18.0 |
| pip | – | justhtml |
< 1.18.0 Fix: upgrade to 1.18.0
|
Original advisory text
justhtml before 1.18.0 Denial of Service via CSS Selector
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r8cj-3554-33m...
- https://github.com/advisories/GHSA-r8cj-3554-33mr
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4671.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4671 Vendor Advisory
- https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-css-s... Vendor Advisory
Severity
8.3
High
CVSS 4.0: 8.7 (NVD)
CVSS 3.1: 7.5 (NVD)
Exploitation
EPSS <1%
Type
CWE-400Uncontrolled Resource Consumption
CWE-407Inefficient Algorithmic Complexity
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published23 Aug 2026
Updated3 Sep 2026
First seen8 May 2026
Monitor software like this
Free during beta