Catastrophic Backtracking Vulnerability in Soup Sieve CSS Selector Library

CVE-2026-49477

What is CVE-2026-49477?

The Soup Sieve CSS selector library, utilized in conjunction with Beautiful Soup 4, is at risk due to a flaw in its CSS selector parser. Prior to releasing version 2.8.4, the parser contained a regular expression that could trigger catastrophic backtracking when processing attribute selectors with unterminated quoted values. This vulnerability allows attackers capable of sending untrusted CSS selector strings to functions like soupsieve.compile() or Beautiful Soup's select() and select_one() to exploit the system, leading to CPU exhaustion and effectively causing a denial of service. The issue has been addressed and patched in version 2.8.4.

References