CVE-2026-49477

Name of the Vulnerable Software and Affected Versions soupsieve (affected versions not specified)

Description The CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking, which occurs when the regex engine takes an exponential amount of time to process a specific input. This happens when the parser processes an attribute selector with an unterminated quoted value, causing the VALUE regex pattern in soupsieve/css parser.py to enter a loop of exponential backtracking. A small payload of approximately 300 bytes can cause the regex engine to hang for over 3 seconds, leading to a Regular Expression Denial of Service (ReDoS). This issue affects any application that passes untrusted CSS selector strings to the soupsieve.compile() function or Beautiful Soup's .select() and .select one() methods. The attack consumes CPU resources and can block worker threads, potentially leading to complete service denial in threaded or async web applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid passing untrusted user input to the soupsieve.compile() function or Beautiful Soup's .select() and .select one() methods.