CVE-2026-9769
Received Received - Intake

Uncontrolled Recursion in JustHTML Parser

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-9769
EUVD
EUVD-2026-64661

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
emilstenstrom justhtml 1.9.1
emilstenstrom justhtml to 1.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the JustHTML library versions 1.9.1 and earlier. It allows a denial of service (DoS) attack by providing deeply nested HTML input. The issue occurs during parsing when the library recursively traverses the DOM tree without a depth limit, causing a RecursionError when the nesting exceeds Python's default recursion limit.

Detection Guidance

To detect this vulnerability, monitor for RecursionError exceptions in applications using justhtml versions 1.9.1 or earlier. Check logs for parsing failures or process terminations during HTML processing. Use tools like grep to search for 'RecursionError' or 'RecursionError: maximum recursion depth exceeded' in application logs.

Impact Analysis

An attacker can exploit this by sending HTML with deeply nested tags (e.g., 1000 nested <div> tags). This may cause parsing to fail, requests to abort, or even terminate the host application's worker or process, depending on how exceptions are handled.

Compliance Impact

This vulnerability primarily causes denial of service by crashing applications processing deeply nested HTML. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR or HIPAA. However, service disruption from a DoS could indirectly impact compliance by failing to provide timely access to systems handling personal or health data.

Mitigation Strategies

Immediately upgrade justhtml to version 1.10.0 or later. If upgrading is not possible, implement input validation to limit HTML nesting depth or configure CPython's recursion limit using sys.setrecursionlimit() as a temporary workaround. Ensure host applications handle RecursionError exceptions gracefully.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart