CVE-2026-9769: JustHTML uncontrolled recursion DoS via deeply nested HTML

CVE-2026-9769 · Severity: high · CVSS 7.5 · Published 2026-08-23

JustHTML is a Python HTML parsing library used to sanitize and process HTML content. An attacker can craft malicious HTML with deeply nested tags to trigger a crash during parsing. Depending on how an application handles exceptions, this could cause request failures, service interruption, or worker process termination—effectively a denial-of-service attack.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-9769 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9769 being exploited in the wild.
How severe is CVE-2026-9769?
High severity, with a CVSS score of 7.5, published 23 August 2026.
Which products and versions are affected?
justhtml (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.10.0.
Is there a fix for CVE-2026-9769?
Yes. justhtml (PyPI): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9769 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9769?
Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • justhtml (PyPI): upgrade to 1.10.0 or later
    pip install "justhtml>=1.10.0"

Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in the JustHTML DOM tree traversal functions. The root cause is in _find_elements() (and related functions like _node_to_html(), clone_node(deep=True), and _to_markdown_walk()), which recursively walk the DOM tree without enforcing a depth limit. When JustHTML.__init__() parses HTML, it unconditionally calls TreeBuilder.finish() → _populate_selectedcontent() → _find_elements(), which recursively traverses all nodes. On CPython with the default recursion limit of 1000, approximately 11 KB of nested &lt;div&gt; tags triggers RecursionError. No authentication or special privileges are required; any attacker who can supply HTML input (via web form, API, file upload, etc.) can trigger the error. The attack vector is network-based with low complexity. The library already demonstrates the correct pattern using iterative traversal in comparable functions, and a fix is available in version 1.10.0 by converting recursive implementations to iterative stack-based traversal.

Affected products

  • Emil Stenstrom JustHTML <= 1.9.1

Identifiers

  • CVE-2026-9769
  • GHSA-v7cf-c9rm-wm3j
  • PYSEC-2026-3854

Timeline

  • 2026-03-17: disclosed: Published to GitHub Advisory Database
  • 2026-03-15: patched: Fixed in version 1.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.