CVE-2026-49476

HIGH 7.5

Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

CWE	CWE-400 CWE-770
Vendor	facelessuser
Product	soupsieve
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for facelessuser soupsieve

Be the first to know when new high vulnerabilities affecting facelessuser soupsieve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

facelessuser / soupsieve

< 2.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x github.com: https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39 github.com: https://github.com/facelessuser/soupsieve/releases/tag/2.8.4