Emil Stenstrom justhtml up to 1.9.1 TreeBuilder TreeBuilder.finish recursion

Summaryinfo

A vulnerability labeled as problematic has been found in Emil Stenstrom justhtml up to 1.9.1. The impacted element is the function TreeBuilder.finish of the component TreeBuilder. Such manipulation leads to recursion. This vulnerability is traded as CVE-2026-9769. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Emil Stenstrom justhtml up to 1.9.1. Affected by this issue is the function TreeBuilder.finish of the component TreeBuilder. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. CVE summarizes:

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-9769 since 05/27/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.10.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Emil Stenstrom

Name

• justhtml

Version

• 1.9.0
• 1.9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion