Denial of Service Vulnerability in JustHTML Library by Emil Stenstrom

CVE-2026-9769

What is CVE-2026-9769?

The JustHTML library version 1.9.1 is susceptible to a denial of service issue due to uncontrolled recursion in its code. When constructing JustHTML(), the method TreeBuilder.finish() calls _populate_selectedcontent() without imposing a depth limit on the recursion. This can lead to an attacker supplying malicious HTML code, such as deeply nested tags, overwhelming CPython’s default recursion settings. Consequently, this can cause unhandled RecursionError exceptions, potentially resulting in parsing failures or the termination of a worker or process based on how the hosting application manages exceptions.

References