CVE-2026-49477

HighCVSS 7.5

Published: 14/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

Soup Sieve library prior to version 2.8.4 contains a denial-of-service vulnerability due to a regular expression prone to catastrophic backtracking. An attacker can supply an untrusted CSS selector with an unterminated quoted attribute value, causing CPU exhaustion.

Risk Assessment

The organization is at risk of denial-of-service (DoS) attacks by sending a crafted CSS selector to soupsieve.compile() or Beautiful Soup .select()/.select_one(), potentially overloading the server and disrupting application availability.

Recommendation

Immediately upgrade Soup Sieve to version 2.8.4 or later. If an upgrade is not possible, restrict access to CSS selector processing functions to trusted sources only.

Other vulnerabilities in Soup Sieve

CVE-2026-49476High
Soup Sieve before version 2.8.4 allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select()/.select_one(), causing hundreds of megabytes of heap memory allocation and denial of service.

Original NVD description (English source)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.