CVE-2026-49476

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39	Patch
https://github.com/facelessuser/soupsieve/releases/tag/2.8.4	Release Notes
https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x	Exploit Vendor Advisory
https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:facelessuser:soup_sieve:*:*:*:*:*:beautiful_soup:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Soup Sieve es una biblioteca de selectores CSS diseñada para ser utilizada con Beautiful Soup 4. Antes de la versión 2.8.4, el analizador de selectores CSS en soupsieve asigna memoria ilimitada al compilar grandes listas de selectores separadas por comas, permitiendo a un atacante que puede proporcionar una cadena de selector manipulada a soupsieve.compile() o Beautiful Soup .select() / .select_one() asignar cientos de megabytes de memoria de pila a partir de una entrada relativamente pequeña y causar denegación de servicio. Este problema está solucionado en la versión 2.8.4.

Information

Published : 2026-07-14 21:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-49476

Mitre link : CVE-2026-49476

CVE.ORG link : CVE-2026-49476

JSON object : View

Products Affected

facelessuser

soup_sieve

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-49476", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49476", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:26:25.402577Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "facelessuser", "product": "soupsieve", "versions": [{"status": "affected", "version": "< 2.8.4"}]}]}], "published": "2026-07-14T21:17:01.877", "references": [{"url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4."}, {"lang": "es", "value": "Soup Sieve es una biblioteca de selectores CSS dise\u00f1ada para ser utilizada con Beautiful Soup 4. Antes de la versi\u00f3n 2.8.4, el analizador de selectores CSS en soupsieve asigna memoria ilimitada al compilar grandes listas de selectores separadas por comas, permitiendo a un atacante que puede proporcionar una cadena de selector manipulada a soupsieve.compile() o Beautiful Soup .select() / .select_one() asignar cientos de megabytes de memoria de pila a partir de una entrada relativamente peque\u00f1a y causar denegaci\u00f3n de servicio. Este problema est\u00e1 solucionado en la versi\u00f3n 2.8.4."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facelessuser:soup_sieve:*:*:*:*:*:beautiful_soup:*:*", "vulnerable": true, "matchCriteriaId": "6819C9CA-C98C-47D1-B9DE-E6C32A933427", "versionEndExcluding": "2.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}