CVE-2026-126191 · Package
NO FIX YET · SEE WHAT TO DO
Soup Sieve, a CSS selector library used with Beautiful Soup 4, has regular expressions that backtrack exponentially on certain digit escapes in selectors. A short selector string can stall the process compiling it, causing a denial of service.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that accept selector strings from untrusted users and compile them with Soup Sieve or Beautiful Soup's select(). Applications that only use selectors written by their own developers are much less exposed. unknown for exact affected ranges beyond 'prior to 3.0'.
Not affected if trusted-selectors-only
Who cares beautifulsoup, python, soupsieve
pip show soupsieve; versions below 3.0 are affected.soupsieve.compile() or Beautiful Soup select().3.0.Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.