← Back to the live CVE advisory feed

CVE-2026-9769: justhtml

Severity

8.7 (HIGH)

Vendor

EMILSTENSTROM

Affected versions

0 through before 1.10.0

Fixed version

1.10.0

Patch status

Patched

Published

2026-08-23T14:16:55.277

Modified

2026-08-23T14:16:55.277

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

View the official NVD record for CVE-2026-9769

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.