Description

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-23T14:16:55.277Z",
  "pubdate": "2026-08-23T14:16:55.277Z",
  "executiveSummary": "The justhtml library through versions 1.9.1 contains an uncontrolled recursion vulnerability leading to a denial of service (DoS).\nThe flaw stems from the TreeBuilder.finish() function unconditionally calling _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements() and _find_element() without enforcing a depth bound.\nAn external attacker capable of supplying arbitrary HTML payloads for parsing can provide deeply nested elements, such as approximately 1,000 nested <div> tags comprising roughly 11 KB of data, to exceed CPython's default recursion limit.\nThis triggers an unhandled RecursionError that may abort parsing operations, fail incoming requests, or completely terminate a worker or process depending on the exception handling implementation of the host application.\nThe vulnerability poses a severe availability risk to systems processing untrusted HTML input without requiring authentication, elevated privileges, or complex exploitation vectors beyond submitting a crafted payload.",
  "technicalDetails": "The vulnerability resides within the DOM tree processing logic of the justhtml library, specifically affecting the TreeBuilder component during the instantiation and finalization of JustHTML() objects.\nThe root cause of the issue is the lack of depth bounds or recursion safeguards during the tree traversal phase executed by internal helper functions _populate_selectedcontent(), _find_elements(), and _find_element().\nDuring the parsing and construction lifecycle, TreeBuilder.finish() unconditionally invokes _populate_selectedcontent() to evaluate and traverse the parsed Document Object Model.\nBecause the traversal functions call themselves recursively for every child element without tracking recursion depth or utilizing an iterative approach, highly nested DOM structures directly consume stack frames proportional to the nesting depth.\nExploitation occurs when an unauthenticated attacker submits a maliciously crafted HTML document containing extreme nesting, such as ~1000 deeply nested <div> elements within an 11 KB payload, via any input vector processed by the vulnerable parser.\nWhen the parser attempts to process the payload, the recursive calls exhaust the available call stack, breaching CPython's default maximum recursion depth.\nThis results in an unhandled RecursionError exception propagating through the execution context.\nDepending on the architecture and exception handling of the host application embedding justhtml, the untrapped exception can lead to abrupt request failures, parsing thread aborts, or total worker and process termination, resulting in a localized or cascading denial of service condition.\nThe affected versions include all releases of justhtml through 1.9.1, and the vulnerability does not require any specific privileges or network exposure beyond the ability to supply input data to the parsing pipeline."
}