CVE-2026-49477 Details
Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.
A denial-of-service vulnerability has been identified in Soupsieve, a CSS selector library for Beautiful Soup 4, in versions prior to 2.8.4. The issue arises from the CSS selector parser's regular expression, which is susceptible to catastrophic backtracking. This vulnerability can be exploited by an attacker who supplies untrusted CSS selector strings to the Soupsieve compile function or to Beautiful Soup's select or select_one methods. The exploitation leads to CPU exhaustion, causing a denial-of-service condition.
Users can upgrade to Soupsieve version 2.8.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3 | [email protected] | Patch |
| https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 | [email protected] | Release Notes |
| https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| facelessuser soup sieve | < 2.8.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |