Performance Vulnerability in Soup Sieve Library by Facelessuser
CVE-2026-86000
What is CVE-2026-86000?
The Soup Sieve library, which works with Beautiful Soup 4, contains a performance vulnerability in the selector parser prior to version 2.9. This issue arises when an attacker-controlled selector includes an extended identifier or unquoted attribute-value sequence, potentially causing the regular expression engine to explore numerous splits between overlapping character groups. While user-defined selectors accessed through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select() can lead to excessive CPU consumption, applications utilizing hard-coded selectors remain unaffected. This flaw can stall services as it may hold the Python Global Interpreter Lock (GIL) and exhaust application workers. The vulnerability does not result in memory corruption or arbitrary code execution, and it has been rectified in version 2.9.
Affected Version(s)
soupsieve < 2.9