CVE-2026-9769

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.10.0

Description Uncontrolled recursion occurs during the construction of JustHTML(), where the TreeBuilder.finish() function calls populate selectedcontent(). This process recursively traverses the DOM tree using find elements() and find element() without a depth limit. An attacker providing specially crafted HTML with deeply nested elements can exceed the CPython default recursion limit, triggering a RecursionError. This can lead to a denial of service by aborting parsing, failing requests, or terminating the worker process.

Recommendations Update justhtml to version 1.10.0.