CVE-2026-126189
Received Received - Intake

Denial of Service in Soup Sieve CSS Selector Library

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126189
EUVD
EUVD-2026-124548

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
facelessuser soupsieve 4.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in the Soup Sieve library affecting versions prior to 4.0.1. It involves quadratic time complexity when matching the :has() pseudo-class in certain CSS selectors, causing excessive CPU usage. Attackers can exploit this by providing small but deeply nested or wide documents, making applications consume significant CPU resources for seconds to minutes.

Detection Guidance

Detecting this vulnerability requires checking the version of Soup Sieve in use. Run 'pip show soupsieve' or check your project's dependency files (requirements.txt, pyproject.toml) to verify if the installed version is below 4.0.1. If using a package manager, commands like 'npm list soupsieve' or 'pip list --outdated' may also help identify outdated versions.

Impact Analysis

Applications processing untrusted documents with vulnerable Soup Sieve versions may experience prolonged CPU usage, leading to reduced availability. This can cause delays or crashes in services relying on CSS selector matching, especially when using :has() selectors on deeply nested or wide HTML/XML structures.

Mitigation Strategies

Upgrade Soup Sieve to version 4.0.1 or later using 'pip install --upgrade soupsieve'. If upgrading is not immediately possible, avoid using :has() selectors on untrusted input or enforce strict document size limits. Consider adding timeout mechanisms during selector operations to prevent prolonged CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126189. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...