Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
JustHTML may crash when parsing deeply nested HTML
published 11 days ago
Summary
The JustHTML library (versions up to 1.9.1) can stop working if it processes HTML that contains many layers of nested tags. This can cause the application to fail or stop responding, affecting any service that relies on JustHTML for HTML parsing. Updating to JustHTML version 1.10.0 or later, or limiting the depth of HTML input, resolves the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | justhtml | <= 1.9.1 |
Original advisory text
Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.
### Original Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.
### Original Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Severity
8.7
High
CVSS 3.1: 7.5 (GHSA)
CVSS 4.0: 8.7 (GHSA)
Type
CWE-674Uncontrolled Recursion
Timeline
Published23 Aug 2026
Updated25 Aug 2026
First seen25 Aug 2026
Sources
GHSA-892m-gcq8-2468 · GHSA
Monitor software like this
Free during beta