Kaimandalic

**Name of the Vulnerable Software and Affected Versions** Soup Sieve versions prior to 2.9 **Description** An issue exists in the `selector iter` function within `src/soupsieve/css parser.py` where the raw selector is trimmed using `RE WS END`. Because this regular expression is anchored only at the end and used with `search()`, the engine performs a greedy scan at every starting offset. A valid selector containing a long internal whitespace run or a long CSS comment run followed by another token triggers quadratic CPU work. This can be exploited via `soupsieve.compile()` and `BeautifulSoup.select()`. The resulting CPU consumption can hold the Python Global Interpreter Lock (GIL), exhaust workers, and stall services, leading to a Denial of Service (DoS). Applications using only hard-coded selectors are not affected. **Recommendations** Update Soup Sieve to version 2.9. As a temporary mitigation, cap the maximum length of user-supplied CSS selectors before they are compiled.

**Name of the Vulnerable Software and Affected Versions** Soup Sieve versions prior to 2.9 **Description** A Regular Expression Denial of Service (ReDoS) exists in the selector parser located in `src/soupsieve/css parser.py`. The `IDENTIFIER` pattern uses adjacent quantified groups over overlapping character classes, and the `VALUE` pattern embeds `IDENTIFIER` for attribute selectors. When a user-controlled selector contains a long identifier or an unquoted attribute-value run followed by input that causes the match to fail, the regular expression engine performs quadratic backtracking. This can be triggered via `soupsieve.compile()`, `soupsieve.select()`, or `BeautifulSoup.select()`. The resulting high CPU consumption can hold the Python Global Interpreter Lock (GIL), exhaust application workers, and stall the service. Applications using only hard-coded selectors are not affected. **Recommendations** Update Soup Sieve to version 2.9. As a temporary mitigation, restrict the maximum length of user-supplied CSS selectors before they are passed to the parser.