Executive brief
justhtml is a Python library used to parse and process HTML content. The library recursively traverses the HTML document tree without depth limits, allowing an attacker to submit specially crafted HTML with thousands of nested tags to trigger a crash. This causes the parsing to fail or the application process to terminate, resulting in denial of service.
Technical details
The vulnerability exists in the TreeBuilder.finish() and _populate_selectedcontent() methods, which recursively traverse the DOM via _find_elements() and _find_element() without enforcing a recursion depth bound. When an attacker supplies HTML with deeply nested elements (e.g., ~1000 nested div tags, approximately 11 KB), the recursive traversal exceeds CPython's default recursion limit of 1000 and triggers an unhandled RecursionError. The vulnerability is triggered during JustHTML() construction regardless of the sanitize parameter setting. Depending on the host application's exception handling, this can abort parsing, fail requests, or terminate a worker/process. The library offers no built-in protection; mitigation requires host-application exception handling or input constraints. A fix is available in version 1.10.0, which replaces recursive tree traversal with iterative implementations using an explicit stack.
Affected products
- Emil Stenstrom justhtml through 1.9.1
Timeline
- 2026-03-15: disclosed: Original advisory GHSA-v7cf-c9rm-wm3j published
- 2026-03-15: patched: Fixed in version 1.10.0
- 2026-08-23: advisory: Duplicate advisory GHSA-892m-gcq8-2468 published; withdrawn 2026-08-25
- 2026-08-23: other: CVE-2026-9769 assigned