CVE-2026-49476

HighCVSS 7.5

Published: 14/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

Soup Sieve before version 2.8.4 allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select()/.select_one(), causing hundreds of megabytes of heap memory allocation and denial of service.

Risk Assessment

The organization is exposed to a DoS attack that can exhaust server memory and disrupt applications using Beautiful Soup. Even a small crafted selector can cause significant memory consumption.

Recommendation

Immediately upgrade Soup Sieve to version 2.8.4 or later. If an upgrade is not possible, restrict access to CSS selector processing functions to trusted users only.

Other vulnerabilities in Soup Sieve

CVE-2026-49477High
Soup Sieve library prior to version 2.8.4 contains a denial-of-service vulnerability due to a regular expression prone to catastrophic backtracking. An attacker can supply an untrusted CSS selector with an unterminated quoted attribute value, causing CPU exhaustion.

Original NVD description (English source)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.