CPU Consumption Vulnerability in Soup Sieve CSS Selector Library by Faceless User

CVE-2026-85999

What is CVE-2026-85999?

The Soup Sieve CSS selector library is vulnerable to a CPU consumption issue prior to version 2.9. The vulnerability arises when user-controlled valid selectors, particularly those with long internal whitespace runs or CSS comments, are processed. This leads to excessive CPU work due to inefficient trimming of raw selectors in the parsing phase, potentially stalling services by exhausting system resources. Although it does not result in memory corruption or code execution, the performance impact can be severe, particularly in applications that utilize user-defined selectors through methods like soupsieve.compile() and BeautifulSoup.select(). The issue is resolved in version 2.9.

References