An uncontrolled recursion vulnerability in the justhtml library allows unauthenticated attackers to cause a denial of service through specially crafted HTML input.

This is an uncontrolled recursion vulnerability (CWE-674) within the HTML parsing logic. It allows an unauthenticated attacker to exhaust system resources by submitting deeply nested HTML structures, leading to an application crash or service unavailability.

Successful exploitation of this flaw results in a denial of service, which disrupts the availability of applications relying on the justhtml library. Given the CVSS score of 7.5, this high severity issue could lead to significant operational downtime for systems that process untrusted user-supplied HTML content.

Immediate Action: Update the justhtml package to version 1.10.0 or later to incorporate the recursive logic fix.

Proactive Monitoring: Monitor application logs for sudden spikes in memory usage or frequent process restarts that may indicate attempts to exploit this recursion flaw.

Compensating Controls: Implement input validation to restrict the depth of nested HTML tags at the application level to mitigate the impact until the library can be updated.

Public Exploit Available: No (exploit_available unknown)

This vulnerability presents a high risk to service availability for affected web applications. Security teams should prioritize updating the justhtml dependency to version 1.10.0 to eliminate the underlying recursive logic flaw.