CVE-2026-4671 (CVSS 7.5 HIGH): justhtml before 1.18.0 contains multiple low

The justhtml library, a Python package often used for HTML sanitization and processing, has been found to contain several low-severity Denial of Service (DoS) vulnerabilities, collectively tracked as CVE-2026-4671. These issues, present in versions prior to 1.18.0, primarily stem from inefficient or exploitable handling of CSS selector strings and text linkification, allowing an attacker to trigger disproportionate resource consumption.

- Affected Library: justhtml - Vulnerable Versions: All versions before 1.18.0 - CVE ID: CVE-2026-4671 (CVSS 7.5 HIGH) - Vulnerability Type: Multiple Denial of Service (DoS) issues. - Exploitation Vectors: Applications evaluating attacker-controlled CSS selector strings (e.g., via query() , matches() ), running selector matching over large untrusted documents, constructing DOM trees from untrusted structures, or enabling linkification over attacker-controlled text. - Specific Triggers: Oversized selectors, large selector lists, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs, and malformed linkification input (punctuation-heavy, trailing brackets). - Impact: Excessive CPU or memory usage, leading to service degradation or unavailability. No direct script execution, data disclosure, or sanitizer bypass. - Default Usage: JustHTML(sanitize=True) is generally not exposed to these specific selector-based vulnerabilities as selectors are typically application-controlled.

While individually described as "low-severity" DoS issues, the sheer number and variety of triggers within justhtml 's selector and linkification processing create a significant availability risk. For applications that handle untrusted user input and then process it with justhtml – especially those that dynamically evaluate CSS selectors or perform linkification on user-supplied text – these vulnerabilities can be easily exploited. A successful DoS attack, even without data compromise, can cripple services, leading to financial losses, reputational damage, and operational disruption. It underscores that even seemingly benign text processing libraries can introduce critical points of failure if not handled carefully.

- Patch Immediately: Upgrade the justhtml library to version 1.18.0 or newer without delay. - Input Validation & Sanitization: Rigorously validate and sanitize all untrusted input, particularly any strings intended for use as CSS selectors or for linkification, *before* passing them to justhtml . - Restrict Selector Evaluation: Avoid directly evaluating attacker-controlled strings as CSS selectors. If dynamic selectors are necessary, implement strict allow-listing or robust escaping mechanisms. - Monitor Resource Usage: Implement monitoring for CPU and memory consumption in applications that utilize justhtml to quickly detect and respond to potential DoS attempts.

This is a summary of reporting by NVD (NIST) . Read the full original article ↗

Get these alerts first.

Every story hits our Telegram channel the moment it publishes.