---
id: "CVE-2026-126193"
page: "https://infrastack.ai/live/CVE-2026-126193"
kind: "vulnerability"
aliases: ["CVE-2026-126193"]
title: "Soup Sieve: deeply nested selectors crash parsing with a recursion error"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["beautifulsoup", "package", "python", "soupsieve"]
not_affected_if: ["fixed-selectors", "trusted-input-only"]
published_at: "2026-11-12T17:17:32+00:00"
first_seen_at: "2026-11-12T17:39:38+00:00"
updated_at: "2026-11-12T17:40:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126193", "first_seen_at": "2026-11-12T17:39:38+00:00"}]
exploit_sources: []
---

# Soup Sieve: deeply nested selectors crash parsing with a recursion error

Link for people: https://infrastack.ai/live/CVE-2026-126193 (this .md is for agents)

Soup Sieve, the CSS selector library used by Beautiful Soup, recurses without limit on deeply nested pseudo-class selectors and raises a RecursionError. An attacker who can supply selectors can make the affected request or task fail, a denial of service for that request only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show soupsieve` and check whether the installed version is below `3.0`.
- Search dependency lockfiles for `soupsieve` to find every place it is pinned.

## Fix

- Soup Sieve: upgrade to `3.0`.

## Timeline

- 2026-11-12T17:39:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126193

## Documents

- [advisory] Vendor advisory: github.com https://github.com/facelessuser/soupsieve/security/advisories/GHSA-7g44-g9rc-x53w
- [fix] Patch: github.com https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee
- [fix] Release notes: github.com https://github.com/facelessuser/soupsieve/releases/tag/3.0

## From the sources

Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise  RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_