Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-9769: JustHTML: Deeply Nested HTML Triggers Crash
CVE-2026-9769 · published 11 days ago
Summary
JustHTML versions 1.0 through 1.9.1 can crash or freeze if it's given very deeply nested HTML input. This could cause a service to become unresponsive or stop working. To fix, update to version 1.9.2 or later.
What to do
- Update justhtml to version 1.10.0.
- Update emilstenstrom justhtml to version 1.10.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | justhtml |
<= 1.9.1 Fix: upgrade to 1.10.0
|
| – | emilstenstrom | justhtml | < 1.10.0 |
Original advisory text
justhtml before 1.10.0 Denial of Service via deeply nested HTML
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3...
- https://github.com/EmilStenstrom/justhtml/releases/tag/v1.10.0
- https://github.com/advisories/GHSA-v7cf-c9rm-wm3j
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9769.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9769 Vendor Advisory
- https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deepl... Vendor Advisory
Severity
8.7
High
CVSS 4.0: 7.1 (GHSA)
CVSS 4.0: 8.7 (NVD)
CVSS 3.1: 7.5 (NVD)
Exploitation
EPSS <1%
Type
CWE-674Uncontrolled Recursion
Timeline
Published23 Aug 2026
Updated2 Sep 2026
First seen17 Mar 2026
Monitor software like this
Free during beta