CVE-2026-4671: Uncontrolled Resource Consumption in EmilStenstrom justhtml

CVE-2026-4671 describes multiple denial-of-service issues in EmilStenstrom justhtml before version 1.18.0. The vulnerabilities arise from uncontrolled resource consumption during CSS selector processing and linkification when attacker-controlled input is evaluated via query(), matches(), or selector-based transforms. Specific triggers include oversized or complex selectors, deeply nested pseudo-classes, cyclic DOM graphs causing infinite traversal, and punctuation-heavy linkification input. These issues affect availability only and do not allow code execution or data disclosure. The default configuration with sanitization enabled is not expected to expose these flaws.

The impact is limited to denial-of-service conditions caused by excessive CPU or memory usage when processing crafted selectors or text. There is no impact on confidentiality, integrity, or code execution. Applications that evaluate untrusted selectors or construct DOM trees from untrusted sources are at risk of resource exhaustion, potentially leading to service disruption.

No official patch or remediation level is currently documented. Users should avoid evaluating attacker-controlled selector strings or processing large untrusted documents with vulnerable justhtml versions. Using the default sanitization mode (sanitize=True) reduces exposure since selectors are normally application-controlled. Monitor vendor advisories for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.