CVE-2026-4671

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.18.0

Description Multiple low-severity denial-of-service issues exist in CSS selector handling and linkification. Applications may consume disproportionate CPU or memory when evaluating attacker-controlled selector strings via query(), matches(), or selector-based transforms, running selector matching over very large untrusted documents, constructing DOM trees from untrusted structure, or enabling linkification over attacker-controlled text. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These issues affect availability and do not allow script execution, data disclosure, or sanitizer bypass.

Recommendations Update to version 1.18.0 or later.