# CVE-2026-4671: justhtml denial-of-service in CSS selector handling and linkification

Source: https://junglewise.ai/threats/cve-2026-4671-justhtml-denial-of-service-in-css-selector-handling-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-4671 · Severity: high · CVSS 7.5 · Published 2026-08-23

justhtml is a Python library for parsing and sanitizing HTML documents. Versions before 1.18.0 contain multiple denial-of-service vulnerabilities where attackers can craft malicious CSS selectors or linkification input to consume excessive CPU or memory, potentially making applications unresponsive. While these issues do not allow unauthorized data access or code execution, they can disrupt service availability for applications that process untrusted selector strings or large documents.

Technologies: [justhtml (PyPI)](https://junglewise.ai/threats/technologies/justhtml). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-4671 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4671 being exploited in the wild.

**How severe is CVE-2026-4671?** High severity, with a CVSS score of 7.5, published 23 August 2026.

**Which products and versions are affected?** justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.18.0.

**Is there a fix for CVE-2026-4671?** Yes. justhtml (PyPI): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4671 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-4671?** Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- justhtml (PyPI): upgrade to 1.18.0 or later

  ```sh
  pip install "justhtml>=1.18.0"
  ```


## Technical details

The vulnerability encompasses multiple denial-of-service issues in CSS selector parsing and matching, and in URL linkification logic. Attack vectors include oversized selectors, large selector lists, long combinator chains, deeply nested pseudo-classes like :not(), repeated token/attribute matching, cyclic DOM graphs, and punctuation-heavy linkification input. These triggers cause resource exhaustion through inefficient algorithmic complexity and uncontrolled resource consumption (CWE-400, CWE-407, CWE-835). Exploitation requires passing attacker-controlled selector strings to query(), matches(), or selector-based transforms, or enabling linkification on untrusted text. Default sanitization via JustHTML(sanitize=True) is not exposed because selectors are normally application-controlled. The patch in 1.18.0 introduces resource limits, structural caps, and removes repeated-work hot paths.

## Affected products

- EmilStenstrom justhtml before 1.18.0

## Identifiers

- CVE-2026-4671
- GHSA-r8cj-3554-33mr

## Timeline

- 2026-05-04: disclosed
- 2026-05-04: patched: Version 1.18.0 released

## References

- [https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r8cj-3554-33mr](https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r8cj-3554-33mr)
- [https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-css-selector](https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-css-selector)

## Related threats

- [justhtml uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6)
- [JustHTML uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html)
- [justhtml mutation XSS in raw-text element serialization](https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization)
- [justhtml HTML escaping bypass in Markdown conversion](https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion)
- [justhtml HTML sanitization bypass leading to XSS](https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss)