CVE-2026-49476

Name of the Vulnerable Software and Affected Versions soupsieve versions prior to 2.8.4

Description The CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists. An attacker can provide a crafted selector string to the soupsieve.compile() function or Beautiful Soup's .select() and .select one() methods to cause the application to allocate hundreds of megabytes of heap memory from a relatively small input. For example, a 500 KB selector string can trigger an allocation of approximately 244 MB of heap memory, resulting in a 488x amplification ratio. This memory exhaustion can lead to denial of service through OOM (Out of Memory) kills in containerized environments, swap thrashing on bare-metal servers, or process termination via a MemoryError exception. The root cause is the lack of a limit on the number of selectors in a comma-separated list, where each selector object consumes approximately 976 bytes of heap memory.

Recommendations Update soupsieve to version 2.8.4. As a temporary mitigation, restrict or validate user-supplied CSS selectors before they are passed to soupsieve.compile(), .select(), or .select one() to ensure they do not contain an excessive number of comma-separated items.