CVE-2026-126189Medium· 5.3▾ SunlitSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.
soupsieve < 4.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-126190High· 7.5Soup Sieve: Polynomial-time denial of service in the descendant combinator
CVE-2026-126192Medium· 6.3Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
CVE-2026-126191High· 7.5Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
CVE-2026-126193Medium· 5.3Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack
CVE-2026-86000Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-85999Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4