CVE-2026-9769 EmilStenstrom CVE debrief

Who should care

Defenders responsible for systems that use justhtml for HTML parsing, particularly those handling untrusted or user-supplied HTML content, should assess exposure and prioritize mitigation.

Why it matters

CVE-2026-9769 is a denial-of-service vulnerability in justhtml that can lead to a RecursionError and potentially terminate a worker/process. Defenders should prioritize upgrading to justhtml version 1.10.0 or later and assess systems that use justhtml for HTML parsing, particularly those handling untrusted or user-supplied HTML content.

• Potential termination of worker/process due to unhandled RecursionError
• Denial-of-service attacks through deeply nested HTML elements
• Need for verification of affected versions and remediation status
• Potential impact on system availability and reliability

Technical summary

The justhtml package is vulnerable to a denial-of-service attack due to uncontrolled recursion during HTML parsing. This occurs when the _populate_selectedcontent() function in TreeBuilder.finish() recursively traverses the DOM tree without a depth bound, allowing an attacker to provide deeply nested elements to exceed CPython's default recursion limit and trigger an unhandled RecursionError. The vulnerability affects justhtml versions up to 1.9.1 and is fixed in version 1.10.0. Defenders should prioritize upgrading to justhtml version 1.10.0 or later to mitigate this vulnerability. Systems that use justhtml for HTML parsing should be assessed for exposure, particularly those that handle untrusted or user-sup-

Defensive priority

Defenders should prioritize upgrading to justhtml version 1.10.0 or later to mitigate this vulnerability. Systems that use justhtml for HTML parsing should be assessed for exposure, particularly those that handle untrusted or user-supplied HTML content.

Recommended defensive actions

• Upgrade to justhtml version 1.10.0 or later
• Assess systems that use justhtml for HTML parsing, particularly those handling untrusted or user-supplied HTML content
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the _populate_selectedcontent() function in TreeBuilder.finish() which recursively traverses the DOM tree without a depth bound. An attacker can provide deeply nested elements (e.g., ~1000 nested <div> tags) to exceed CPython's default recursion limit and trigger an unhandled RecursionError.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.