Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 23 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-03-15: Fixed in version 1.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

justhtml uncontrolled recursion DoS via deeply nested HTML

Severity: high · CVSS 7.5 · Published 2026-08-23

justhtml is a Python library used to parse and process HTML content. The library recursively traverses the HTML document tree without depth limits, allowing an attacker to submit specially crafted HTML with thousands of nested tags to trigger a crash. This causes the parsing to fail or the application process to terminate, resulting in denial of service.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) <= 1.9.1.
Is there a fix for This vulnerability?: A patch was published on 2026-03-15: Fixed in version 1.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the TreeBuilder.finish() and _populate_selectedcontent() methods, which recursively traverse the DOM via _find_elements() and _find_element() without enforcing a recursion depth bound. When an attacker supplies HTML with deeply nested elements (e.g., ~1000 nested div tags, approximately 11 KB), the recursive traversal exceeds CPython's default recursion limit of 1000 and triggers an unhandled RecursionError. The vulnerability is triggered during JustHTML() construction regardless of the sanitize parameter setting. Depending on the host application's exception handling, this can abort parsing, fail requests, or terminate a worker/process. The library offers no built-in protection; mitigation requires host-application exception handling or input constraints. A fix is available in version 1.10.0, which replaces recursive tree traversal with iterative implementations using an explicit stack.

Affected products

Emil Stenstrom justhtml through 1.9.1

Timeline

2026-03-15: disclosed: Original advisory GHSA-v7cf-c9rm-wm3j published
2026-03-15: patched: Fixed in version 1.10.0
2026-08-23: advisory: Duplicate advisory GHSA-892m-gcq8-2468 published; withdrawn 2026-08-25
2026-08-23: other: CVE-2026-9769 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.