CVE-2026-9769: Uncontrolled Recursion in EmilStenstrom justhtml
Description
justhtml versions prior to 1.10.0 contain an uncontrolled recursion vulnerability that can lead to denial of service. The issue arises during the construction of JustHTML() where TreeBuilder.finish() calls _populate_selectedcontent(), which recursively traverses the DOM tree without limiting recursion depth. An attacker supplying deeply nested HTML elements can exceed Python's recursion limit, causing a RecursionError that may abort parsing or terminate processes depending on exception handling.
CVSS v4.0
Score 8.7high
Affected software
EmilStenstrom
justhtml
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-9769 affects justhtml through version 1.9.1 and is fixed in 1.10.0. The vulnerability is due to uncontrolled recursion in the TreeBuilder.finish() method, which calls _populate_selectedcontent() that recursively traverses the DOM tree without a depth bound. By providing deeply nested HTML (e.g., ~1000 nested <div> tags), an attacker can trigger a RecursionError in CPython, potentially causing denial of service by aborting parsing or terminating worker processes depending on the host application's handling of exceptions.
Potential Impact
An attacker able to supply HTML for parsing can cause denial of service by triggering a RecursionError due to excessive recursion depth. This may result in aborted parsing, failed requests, or termination of worker processes, impacting availability of the affected application.
Mitigation Recommendations
A fix is available in justhtml version 1.10.0. Users should upgrade to version 1.10.0 or later to remediate this vulnerability. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-27T20:38:38.588Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8afb29acd9273b49f5f751
Added to database: 08/23/2026, 13:52:41 UTC
Last enriched: 09/10/2026, 12:52:32 UTC
Last updated: 10/06/2026, 06:48:21 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.