The justhtml library up to version 1.9.1 suffers from uncontrolled recursion during HTML parsing. Specifically, the TreeBuilder.finish() method calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a recursion depth limit. An attacker able to supply crafted HTML with deeply nested elements (e.g., ~1000 nested <div> tags) can exceed CPython's default recursion limit, causing an unhandled RecursionError. This can lead to denial of service by aborting parsing, failing requests, or terminating worker processes depending on the host application's exception handling. The vulnerability is addressed in justhtml version 1.10.0.

Exploitation of this vulnerability allows an attacker to cause a denial of service by triggering a RecursionError during HTML parsing. This can result in aborted parsing operations, failed requests, or termination of worker processes, impacting availability of applications using affected justhtml versions.

Upgrade justhtml to version 1.10.0 or later where this uncontrolled recursion vulnerability is fixed. No official patch or temporary fix is indicated other than upgrading. Until upgraded, applications should consider limiting or sanitizing input HTML depth if possible to mitigate risk.