justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.

CVE-2026-9769 affects the justhtml Python library through version 1.9.1, fixed in 1.10.0. The vulnerability involves uncontrolled recursion during HTML parsing via the JustHTML() constructor. TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree through _find_elements()/_find_element() without any depth limit. An attacker supplying crafted HTML with deeply nested elements (approximately 1000 nested div tags, ~11 KB) can exceed CPython's default recursion limit. This triggers an unhandled RecursionError that can abort parsing, fail requests, or terminate worker processes. The impact depends on the host application's exception handling behavior, making it a denial of service risk for applications that parse untrusted HTML input.