CVE-2026-126191

HIGH 7.5

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0.

CWE	CWE-1333
Vendor	facelessuser
Product	soupsieve
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for facelessuser soupsieve

Be the first to know when new high vulnerabilities affecting facelessuser soupsieve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

facelessuser / soupsieve

< 3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x github.com: https://github.com/facelessuser/soupsieve/pull/300 github.com: https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e github.com: https://github.com/facelessuser/soupsieve/releases/tag/3.0