Search

CVE-2026-4671 - justhtml before 1.18.0 Denial of Service via CSS Selector

CVE ID : CVE-2026-4671 Published : Aug. 23, 2026, 2:16 p. m. • 6 hours, 54 minutes ago Description : justhtml before 1. 18. 0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input.