A remote, unauthenticated attacker can crash applications using the justhtml library by providing maliciously crafted CSS selectors that cause resource exhaustion.

This issue is a CWE-400 vulnerability where the parser fails to properly constrain the resources used when processing specific CSS selectors. An unauthenticated attacker can send a crafted input to cause a denial of service.

Denial of service attacks can effectively take an application offline, resulting in service unavailability and potential business disruption. With a CVSS score of 7.5, this vulnerability highlights a significant risk to the availability of systems relying on the justhtml library.

Immediate Action: Upgrade the justhtml package to version 1.18.0 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor application health and resource usage, specifically looking for abnormal latency or memory consumption during CSS parsing operations.

Compensating Controls: Use a Web Application Firewall (WAF) to filter or rate-limit requests that contain complex or suspicious CSS payloads.

Public Exploit Available: No

The fix for this vulnerability is readily available in version 1.18.0. Organizations should schedule an immediate update to this version to ensure the integrity and availability of their applications against potential denial of service attacks.