DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-86000: CVE-2026-86000: Polynomial-Time Regular Expression Denial of Service in Soup Sieve Selector Parser

#security #cve #cybersecurity

CVE-2026-86000: Polynomial-Time Regular Expression Denial of Service in Soup Sieve Selector Parser

Vulnerability ID: CVE-2026-86000
CVSS Score: 5.3
Published: 2026-09-17

A regular expression denial of service (ReDoS) vulnerability in Soup Sieve prior to version 2.9 allows remote attackers to cause CPU exhaustion and service disruption. The issue lies within the definition of the IDENTIFIER and VALUE selector sub-patterns in the CSS parser component, which uses overlapping adjacent quantified groups. When parsing long, crafted, or unclosed CSS selectors, backtracking-based regular expression engines experience quadratic performance degradation. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected.

TL;DR

Unauthenticated remote attackers can cause denial of service (CPU exhaustion) via crafted CSS selectors in Soup Sieve's parser before version 2.9.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1333
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.3 (Medium)
  • EPSS Score: Not Available
  • Primary Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: Proof-of-Concept Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Soup Sieve
  • Beautiful Soup 4 (via select method)
  • soupsieve: < 2.9 (Fixed in: 2.9)

Code Analysis

Commit: ce44e49

Fix catastrophic backtracking ReDoS vector in selector IDENTIFIER sub-pattern by restructuring the prefix-continuation logic to be deterministic.

Mitigation Strategies

  • Upgrade Soup Sieve to version 2.9 or newer to completely resolve the inefficient regex pattern.
  • Sanitize and limit the length of untrusted CSS selectors accepted from users before parsing.
  • Isolate untrusted document and selector parsing tasks to sub-processes with strict timeouts.

Remediation Steps:

  1. Identify instances of the soupsieve package in your environment using dependency scanners or command-line tools: pip show soupsieve
  2. Update the package in your requirements.txt, setup.py, or Pipfile to point to version 2.9 or higher: pip install -U soupsieve
  3. Implement an input length validator in application code paths that compile arbitrary CSS selectors, rejecting any strings longer than 128 characters.
  4. Run parsing workflows inside a multiprocessing pool or celery tasks with short time-limits to prevent single-process worker exhaustion.

References

Read the full report for CVE-2026-86000 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)