justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-9769 affects justhtml library versions through 1.9.1, exposing applications to denial of service attacks through uncontrolled recursion. When the library parses HTML during JustHTML construction, the TreeBuilder.finish() method calls _populate_selectedcontent(), which recursively traverses the DOM tree without enforcing depth limits. An attacker can exploit this by supplying deeply nested HTML elements—as few as ~1000 nested tags in roughly 11 KB of data—to exceed Python's default recursion limit and crash the application. This vulnerability impacts any system using justhtml to process untrusted HTML input, including web applications, document processors, and content management systems that rely on this library for parsing.
While this CVE doesn't map to specific MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect the attack patterns associated with resource exhaustion and application crashes. Practitioners using Casky would identify suspicious HTML parsing behavior through analysis of recursive call stacks, excessive memory consumption during DOM traversal, and application crashes tied to input processing. Claude's extended reasoning would correlate deeply nested HTML structures with denial of service intent, helping security teams recognize when attackers are sending specially crafted payloads designed to trigger uncontrolled recursion. Detection findings would highlight the absence of recursion depth validation as a critical control gap, enabling teams to prioritize patching to version 1.10.0 or implementing input sanitization to limit nesting depth before parsing.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-9769. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation