CVE-2026-126190
Soup Sieve: Polynomial-time denial of service in the descendant combinator
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.
| CWE | CWE-407 |
| Vendor | facelessuser |
| Product | soupsieve |
| Published | Nov 12, 2026 |
Get instant alerts for facelessuser soupsieve
Be the first to know when new high vulnerabilities affecting facelessuser soupsieve are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H