EUVD-2026-81689
GHSA-gjv8-xp57-g29c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remotely reachable with a simple crafted selector (AV:N/AC:L/PR:N/UI:N); impact limited to CPU-exhaustion availability loss (A:L), no confidentiality/integrity effect and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.
AnalysisAI
Denial of service in Soup Sieve, the CSS selector library used by Beautiful Soup 4, affects all versions prior to 2.9 and is triggered when an application passes attacker-controlled CSS selectors into soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(). The parser's IDENTIFIER regular expression contains adjacent quantified groups over overlapping character classes, so a long identifier or unquoted attribute-value run followed by input that makes the overall match fail - upstream's own regression test uses a selector such as "[a=" plus 12,000 'a' characters - forces the regex engine to explore quadratically many splits, burning CPU while holding the Python GIL and stalling workers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the application pass ATTACKER-CONTROLLED CSS selectors into soupsieve via soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(); the malicious selector must contain a long identifier or unquoted attribute-value run followed by input that makes the overall match fail (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but low-severity availability issue, correctly scored 5.3 by the vendor (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to soupsieve 2.9 or later (pip install --upgrade "soupsieve>=2.9", then confirm with pip show soupsieve), which incorporates the parser rewrite in commit ce44e4996e6632871c18cdd7a7fb641be8ef34ef and the new performance regression tests; the advisory and release notes are at https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c and https://github.com/facelessuser/soupsieve/releases/tag/2.9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today