Uncontrolled Recursion

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Uncontrolled Recursion in the construction, when parsing deeply nested HTML structures. An attacker can cause the application to terminate unexpectedly or fail requests by...

PT-2026-28775

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML. init always reaches TreeBuilder.finish, which unconditionally calls populate selectedcontent. That function recursively traverses the DOM via find elements / find element without a depth boun...

PT-2026-79778

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.10.0 Description Uncontrolled recursion occurs during the construction of JustHTML, where the TreeBuilder.finish function calls populate selectedcontent. This process recursively traverses the DOM tree using find...