---
id: CVE-2026-126189
title: 'Soup Sieve: Quadratic-time denial of service when matching `:has()`'
summary: >-
  Soup Sieve is a CSS selector library designed to be used with Beautiful Soup
  4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each
  candidate evaluated by :has() and repeatedly reevaluates a parent containing
  :has…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-407
vendor: facelessuser
product: soupsieve
affected:
  - soupsieve < 4.0.1
published: '2026-11-12'
updated: '2026-11-12'
sourceUpdated: '2026-11-12T16:53:00.822Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-126189'
references:
  - url: >-
      https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw
    label: >-
      https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw
  - url: 'https://github.com/facelessuser/soupsieve/pull/352'
    label: 'https://github.com/facelessuser/soupsieve/pull/352'
  - url: >-
      https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379
    label: >-
      https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379
  - url: >-
      https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44
    label: >-
      https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44
  - url: 'https://github.com/facelessuser/soupsieve/releases/tag/4.0.1'
    label: 'https://github.com/facelessuser/soupsieve/releases/tag/4.0.1'
tags:
  - cve.org
ingestedAt: '2026-11-12T17:51:14.510Z'
---

## Overview

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.

## Affected

- `soupsieve < 4.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.