CVE-2026-4671 Overview
CVE-2026-4671 affects the justhtml Python library in versions prior to 1.18.0. The library contains multiple denial-of-service issues in CSS selector handling and linkification routines. Applications that evaluate attacker-controlled selector strings through query(), matches(), or selector-based transforms can consume disproportionate CPU or memory. The same conditions apply to selector matching over large untrusted documents, DOM tree construction from untrusted structure, and linkification of attacker-controlled text. The issue is tracked under [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Remote unauthenticated attackers can exhaust CPU or memory on applications that pass untrusted selectors or documents to justhtml, degrading availability of the host service.
Affected Products
- justhtml Python library versions prior to 1.18.0
- Applications exposing justhtml selector APIs (query(), matches()) to untrusted input
- Applications using justhtml linkification over attacker-controlled text
Discovery Timeline
- 2026-08-23 - CVE-2026-4671 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-4671
Vulnerability Analysis
The vulnerability spans several code paths in justhtml that scale poorly with adversarial input. Selector parsing and matching accept unbounded input sizes, so oversized selectors, large selector lists, and oversized compound selectors force the engine into expensive parsing work. Long combinator chains and deeply nested functional pseudo-classes compound the cost during matching against candidate nodes.
DOM traversal is also affected. Cyclic DOM graphs constructed from untrusted structure cause non-terminating traversal because the traversal routines do not track visited nodes. Repeated token and positional matching amplifies work per candidate node when selectors reference the same tokens many times.
The linkification path exhibits pathological behavior on punctuation-heavy input and trailing-bracket sequences. These inputs cause disproportionate scanning during URL boundary detection.
The issues are availability-only. They do not permit script execution, data disclosure, or bypass of the default JustHTML(sanitize=True) sanitizer. Default sanitizer usage is not expected to be reachable, because selectors are normally supplied by application code rather than by attackers.
Root Cause
The root cause is missing input bounds and missing cycle detection across selector parsing, selector matching, DOM traversal, and linkification routines. Algorithmic complexity is not constrained relative to attacker-controlled input length or structure.
Attack Vector
An unauthenticated remote attacker submits crafted selector strings, DOM structures, or text destined for linkification. The application processes the input using justhtml, and the processing thread consumes excessive CPU or memory until the request times out or the process is terminated.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-r8cj-3554-33mr and the VulnCheck Advisory on DoS Vulnerability for the vendor description of trigger conditions.
Detection Methods for CVE-2026-4671
Indicators of Compromise
- Application worker processes hitting CPU saturation while handling requests that invoke justhtml selector or linkification APIs
- Sustained memory growth in Python processes correlated with request bodies containing oversized selectors or deeply nested pseudo-class expressions
- Request timeouts or worker restarts triggered during HTML parsing of externally sourced documents
Detection Strategies
- Instrument calls into justhtmlquery(), matches(), and linkification helpers with per-call duration metrics and alert on outliers
- Inspect HTTP request bodies and query parameters for oversized selector strings, long combinator chains, or punctuation-heavy text passed to endpoints known to invoke justhtml
- Correlate worker restarts and out-of-memory events with recent request logs to identify triggering payloads
Monitoring Recommendations
- Track CPU time and resident memory of Python worker processes at the request granularity
- Log the length and structural depth of selector strings before invoking justhtml APIs
- Alert on repeated 5xx responses or timeouts originating from a single client against endpoints that process untrusted HTML
How to Mitigate CVE-2026-4671
Immediate Actions Required
- Upgrade justhtml to version 1.18.0 or later across all application dependencies
- Audit application code for paths that pass untrusted input into query(), matches(), selector-based transforms, or linkification helpers
- Enforce request-level CPU and wall-clock timeouts on endpoints that invoke justhtml
Patch Information
The fix is delivered in justhtml1.18.0. Update the dependency in requirements.txt, pyproject.toml, or the equivalent manifest, and redeploy. See the GitHub Security Advisory GHSA-r8cj-3554-33mr for the maintainer's release notes.
Workarounds
- Reject selector strings above a conservative length limit before invoking justhtml
- Cap the size and nesting depth of HTML documents accepted from untrusted sources
- Disable linkification for attacker-controlled text until the upgrade is deployed
- Apply per-request CPU and memory limits at the process or container level to bound the blast radius
# Configuration example: upgrade justhtml to the fixed release
pip install --upgrade 'justhtml>=1.18.0'
pip show justhtml | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
