CVE-2026-49477

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3	Patch
https://github.com/facelessuser/soupsieve/releases/tag/2.8.4	Release Notes
https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37	Exploit Vendor Advisory
https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:facelessuser:soup_sieve:*:*:*:*:*:beautiful_soup:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Soup Sieve es una biblioteca de selectores CSS diseñada para ser utilizada con Beautiful Soup 4. Antes de la versión 2.8.4, el analizador de selectores CSS en soupsieve contiene una expresión regular vulnerable a retroceso catastrófico al procesar un selector de atributo con un valor entre comillas sin terminar en soupsieve/css_parser.py, permitiendo a un atacante que puede suministrar cadenas de selectores CSS no confiables a soupsieve.compile() o Beautiful Soup .select() / .select_one() causar agotamiento de CPU y denegación de servicio. Este problema está solucionado en la versión 2.8.4.

Information

Published : 2026-07-14 21:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-49477

Mitre link : CVE-2026-49477

CVE.ORG link : CVE-2026-49477

JSON object : View

Products Affected

facelessuser

soup_sieve

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-49477", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49477", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:49:25.096784Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "facelessuser", "product": "soupsieve", "versions": [{"status": "affected", "version": "< 2.8.4"}]}]}], "published": "2026-07-14T21:17:02.007", "references": [{"url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4."}, {"lang": "es", "value": "Soup Sieve es una biblioteca de selectores CSS dise\u00f1ada para ser utilizada con Beautiful Soup 4. Antes de la versi\u00f3n 2.8.4, el analizador de selectores CSS en soupsieve contiene una expresi\u00f3n regular vulnerable a retroceso catastr\u00f3fico al procesar un selector de atributo con un valor entre comillas sin terminar en soupsieve/css_parser.py, permitiendo a un atacante que puede suministrar cadenas de selectores CSS no confiables a soupsieve.compile() o Beautiful Soup .select() / .select_one() causar agotamiento de CPU y denegaci\u00f3n de servicio. Este problema est\u00e1 solucionado en la versi\u00f3n 2.8.4."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facelessuser:soup_sieve:*:*:*:*:*:beautiful_soup:*:*", "vulnerable": true, "matchCriteriaId": "6819C9CA-C98C-47D1-B9DE-E6C32A933427", "versionEndExcluding": "2.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}