CVE-2026-126193 · Package
NO FIX YET · SEE WHAT TO DO
Soup Sieve, the CSS selector library used by Beautiful Soup, recurses without limit on deeply nested pseudo-class selectors and raises a RecursionError. An attacker who can supply selectors can make the affected request or task fail, a denial of service for that request only.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that pass untrusted or user-supplied CSS selectors to Soup Sieve through Beautiful Soup are exposed. Code that only parses trusted HTML with fixed selectors can skip it. The failure is recoverable and the sources do not show a crash of the whole interpreter or a lasting outage.
Not affected if fixed-selectors, trusted-input-only
Who cares beautifulsoup, python, soupsieve
pip show soupsieve and check whether the installed version is below 3.0.soupsieve to find every place it is pinned.3.0.Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.