p PatchFirst

CVE-2026-9769

CVE-2026-9769 · justhtml before 1.10.0 Denial of Service via deeply nested HTML

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

CVSS 8.7 · Alta · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • justhtml

    Versiones
    • ≥ 0, < 1.10.0: Afectada (semver)
    • 1.10.0: No afectada (semver)

    Actualiza a 1.10.0

  • justhtml PyPI

    Versiones
    • 0.1.0
    • 0.10.0
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.13.1
    • 0.14.0
    • 0.15.0
    • 0.16.0
    • 0.17.0
    • 0.18.0
    • 0.19.0
    • 0.2.0
    • 0.20.0
    • 0.21.0
    • 0.22.0
    • 0.23.0
    • 0.24.0
    • 0.25.0
    • 0.26.0
    • 0.27.0
    • 0.28.0
    • 0.29.0
    • 0.3.0
    • 0.30.0
    • 0.31.0
    • 0.32.0
    • 0.33.0
    • 0.34.0
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.38.0
    • 0.39.0
    • 0.4.0
    • 0.40.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.6.0
    • 0.7.0
    • 0.8.0
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.9.0
    • 1.9.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.10.0

    Actualiza a 1.10.0

Fuentes originales

Comprueba tu servidor →