justhtml versions prior to 1.18.0 contain multiple low-severity denial-of-service issues related to CSS selector handling and linkification. When applications evaluate attacker-controlled selectors via query(), matches(), or selector-based transforms, or process large untrusted documents or linkify attacker-controlled text, they may experience disproportionate CPU or memory consumption. Triggers include oversized selectors, large selector lists, deeply nested pseudo-classes, cyclic DOM graphs causing infinite traversal, and punctuation-heavy linkification inputs. These issues impact availability but do not allow code execution, data disclosure, or sanitizer bypass. The vulnerability is rated with a CVSS 4.0 score of 8.7 (high severity).

The vulnerability can cause denial-of-service conditions by exhausting CPU or memory resources when processing specially crafted selectors or linkification inputs. It does not lead to remote code execution, data leakage, or bypass of security controls. The impact is limited to availability degradation of applications using affected justhtml versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid evaluating untrusted or attacker-controlled selector strings or linkification inputs in justhtml. Use default JustHTML(sanitize=True) configurations where possible, as this reduces exposure. Monitor for updates from the vendor regarding patches or official fixes.