https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:19:37 +0000 https://cve.radiocsirt.org/vuln/cve-2026-9769 <p><strong>Affected:</strong> EmilStenstrom justhtml</p> <p>justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested &lt;div&gt; tags, roughly 11 KB) to exceed CPython&#39;s default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application&#39;s exception handling.</p> <p><strong>Affected:</strong> EmilStenstrom justhtml</p> <p>justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested &lt;div&gt; tags, roughly 11 KB) to exceed CPython&#39;s default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application&#39;s exception handling.</p> https://cve.radiocsirt.org/vuln/cve-2026-9769