CVE-2026-126193
Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.
| CWE | CWE-674 |
| Vendor | facelessuser |
| Product | soupsieve |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for facelessuser soupsieve
Be the first to know when new medium vulnerabilities affecting facelessuser soupsieve are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
facelessuser / soupsieve
>= 0.4, < 3.0
References
github.com: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-7g44-g9rc-x53w github.com: https://github.com/facelessuser/soupsieve/pull/306 github.com: https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee github.com: https://github.com/facelessuser/soupsieve/releases/tag/3.0