CVE-2026-9769

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9769

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9769.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9769

Aliases

Published

2026-08-23T13:34:15Z

Modified

2026-09-10T12:25:56Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

justhtml before 1.10.0 Denial of Service via deeply nested HTML

Details

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested

tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9769.json"
}

References

Affected packages

Git / github.com/emilstenstrom/justhtml

Affected ranges

Type

GIT

Repo

https://github.com/emilstenstrom/justhtml

Events

Introduced

Fixed

5095a058e2bdda67c6d8330d5445c34ddd9863fc

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.0"
        },
        {
            "fixed": "1.9.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.13.1

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.19.0

v0.2.0

v0.20.0

v0.21.0

v0.22.0

v0.23.0

v0.24.0

v0.25.0

v0.26.0

v0.27.0

v0.28.0

v0.29.0

v0.3.0

v0.30.0

v0.31.0

v0.32.0

v0.33.0

v0.34.0

v0.35.0

v0.36.0

v0.37.0

v0.38.0

v0.39.0

v0.4.0

v0.40.0

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.7.0

v0.8.0

v0.9.0

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.4.0

v1.5.0

v1.6.0

v1.7.0

v1.8.0

v1.9.0

v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9769.json"