{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/justhtml--1.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-9769"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["justhtml (\u003c= 1.9.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe justhtml library is susceptible to a denial of service (DoS) vulnerability, tracked as CVE-2026-9769, due to an uncontrolled recursion flaw in its HTML parsing logic. The vulnerability resides in the TreeBuilder.finish() function, which invokes _populate_selectedcontent() to process the DOM tree. This function initiates a recursive traversal using _find_elements() and _find_element() without implementing a depth limit. An attacker can craft a payload containing approximately 1000 deeply nested elements, such as \u0026lt;div\u0026gt; tags, which consumes the stack and triggers an unhandled Python RecursionError. Depending on the architecture of the host application, this exception can result in worker crashes, request failures, or total service disruption. The issue is resolved in version 1.10.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service, potentially causing worker processes or the entire web application to terminate unexpectedly when parsing malicious user-supplied content. This vulnerability affects any application using justhtml as a parser for untrusted HTML inputs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the justhtml dependency to version 1.10.0 or later immediately to incorporate the recursion depth mitigation.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing justhtml to ensure they are not exposing the library's parsing functions to unsanitized, externally-provided HTML content.\u003c/li\u003e\n\u003cli\u003eImplement input validation or limit the maximum payload size/depth before passing data to the justhtml parser if an immediate update is not feasible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-23T17:37:42Z","date_published":"2026-08-23T17:37:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-justhtml-dos/","summary":"The justhtml library version 1.9.1 and earlier is vulnerable to a denial of service attack where malicious, deeply nested HTML tags trigger a Python RecursionError during parsing.","title":"Denial of Service in justhtml via Uncontrolled Recursion","url":"https://feed.craftedsignal.io/briefs/2026-08-justhtml-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Justhtml (\u003c= 1.9.1)","version":"https://jsonfeed.org/version/1.1"}