Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨*CVE* CVE-2026-9769 justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unco… https://www.cve.org/CVERecord?id=CVE-2026-9769 ----- Traducción: CVE-2026-9769 jus… http://infoflow.cloud`
Post summary
The post details a denial‑of‑service vulnerability in JustHTML (CVE‑2026‑9769) and notes it was fixed in version 1.10.0.
CVE-2026-9769 justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unco… https://www.cve.org/CVERecord?id=CVE-2026-9769
Post summary
The tweet announces a denial-of-service vulnerability in justhtml that was fixed in version 1.10.0, emphasizing the need to upgrade to mitigate the issue.
CVE-2026-9769 Denial of Service in justhtml 1.9.1 via Uncontrolled Recursion https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9769
Post summary
A Denial of Service vulnerability using uncontrolled recursion has been identified in justhtml 1.9.1, but no PoC, exploit, or patch details are disclosed.