CVE-2026-126193Medium· 5.3▾ SunlitSoup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untru…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.
soupsieve >= 0.4, < 3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-126191High· 7.5Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
CVE-2026-126189Medium· 5.3Soup Sieve: Quadratic-time denial of service when matching `:has()`
CVE-2026-126190High· 7.5Soup Sieve: Polynomial-time denial of service in the descendant combinator
CVE-2026-126192Medium· 6.3Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
CVE-2026-86000Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-85999Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4