CVE-2026-49476

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Soup Sieve CSS Selector Parsing

Publication date: 2026-07-14

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-28

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49476

Affected Vendors & Products

Vendor	Product	Version / Range
facelessuser	soup_sieve	to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Soup Sieve is a CSS selector library for Beautiful Soup 4. The vulnerability involves unbounded memory allocation when processing large comma-separated selector lists. An attacker can exploit this by providing a crafted selector string to cause excessive memory consumption, leading to denial of service.

Detection Guidance

Check the version of soupsieve installed in your Python environment. If it is below 2.8.4, the system is vulnerable. Run: pip show soupsieve or pip list | grep soupsieve.

Impact Analysis

This vulnerability allows an attacker to consume significant system resources by sending a small crafted input, potentially causing applications using Soup Sieve to crash or become unresponsive. This impacts availability of services relying on the library.

Compliance Impact

Denial of service conditions may violate availability requirements in GDPR and HIPAA. Unplanned downtime could lead to non-compliance with data protection and accessibility standards, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Upgrade soupsieve to version 2.8.4 or later. Use pip install --upgrade soupsieve. If using Beautiful Soup, ensure it depends on a patched version of soupsieve.

Hi! I’m here to help you understand CVE-2026-49476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70