CVE-2026-126191High· 7.5▾ TwilightSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-na…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0.
soupsieve < 3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-126193Medium· 5.3Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack
CVE-2026-86000Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-85999Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-126189Medium· 5.3Soup Sieve: Quadratic-time denial of service when matching `:has()`
CVE-2026-126190High· 7.5Soup Sieve: Polynomial-time denial of service in the descendant combinator
CVE-2026-126192Medium· 6.3Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time