CVE-2026-9769

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9769

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9769.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9769

Aliases

GHSA-v7cf-c9rm-wm3j

Published

2026-08-23T13:34:15.503Z

Modified

2026-08-28T11:30:39.685398112Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

justhtml before 1.10.0 Denial of Service via deeply nested HTML

Details

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls populateselectedcontent(), which recursively traverses the DOM tree via findelements()/findelement() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

Database specific

{
    "cwe_ids": [
        "CWE-674"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9769.json"
}

References

Affected packages

Git / github.com/emilstenstrom/justhtml

Affected ranges

Type

GIT

Repo

https://github.com/emilstenstrom/justhtml

Events

Introduced

Fixed

5095a058e2bdda67c6d8330d5445c34ddd9863fc

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.0"
        },
        {
            "fixed": "1.9.1"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.13.1

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.19.0

v0.2.0

v0.20.0

v0.21.0

v0.22.0

v0.23.0

v0.24.0

v0.25.0

v0.26.0

v0.27.0

v0.28.0

v0.29.0

v0.3.0

v0.30.0

v0.31.0

v0.32.0

v0.33.0

v0.34.0

v0.35.0

v0.36.0

v0.37.0

v0.38.0

v0.39.0

v0.4.0

v0.40.0

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.7.0

v0.8.0

v0.9.0

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.4.0

v1.5.0

v1.6.0

v1.7.0

v1.8.0

v1.9.0

v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9769.json"