CVE-2026-86000 in Soup Sieve
Summary
by MITRE • 09/17/2026
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified as CVE-2024-35195 affects Soup Sieve, a Python library that provides CSS selector functionality for use with Beautiful Soup 4. This security flaw resides within the core regular expression engine used to parse CSS selectors, specifically in the file src/soupsieve/css_parser.py. The root cause is a design issue in how the parser defines identifiers and attribute values using overlapping character classes combined with adjacent quantified groups. When the regex engine attempts to match an input string against these patterns, it employs backtracking algorithms that can exhibit exponential or quadratic time complexity under specific conditions. This behavior creates a potential for ReDoS, where carefully crafted inputs force the engine to explore a vast number of possible parsing paths before determining that no valid match exists.
The technical mechanism behind this vulnerability involves the interaction between identifier definitions and attribute value selectors. The parser defines an IDENTIFIER pattern that includes adjacent quantified groups operating over overlapping character classes. Furthermore, the VALUE pattern embeds the IDENTIFIER logic to handle attribute selectors effectively. When a user-controlled selector contains a long identifier or an unquoted attribute-value sequence followed by input characters that ultimately cause the overall match to fail, the regular expression engine is forced into a state of excessive backtracking. Instead of failing quickly, it explores quadratically many splits between the overlapping groups in an attempt to find a valid configuration for the quantified parts. This computational explosion occurs because the regex engine cannot deterministically decide which group should consume specific characters due to the ambiguity introduced by the overlapping classes and adjacent quantifiers.
From an operational perspective, this vulnerability poses a significant risk of Denial of Service against applications that process user-supplied CSS selectors. Since Soup Sieve is commonly integrated into web scraping frameworks and data processing pipelines, attackers can target endpoints or functions such as soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select() by injecting maliciously crafted selector strings. The resulting CPU consumption from the regex backtracking can hold the Python Global Interpreter Lock for extended periods. In multi-threaded or asynchronous environments, this locks up application workers, effectively exhausting available resources and stalling services. It is important to note that while the impact on availability is severe due to resource exhaustion, the vulnerability does not lead to memory corruption, arbitrary code execution, or data leakage. The issue is strictly limited to performance degradation caused by computational complexity.
The risk profile of this vulnerability depends heavily on how selectors are generated within an application. Applications that rely exclusively on hard-coded, static CSS selectors defined by developers are unaffected because the input does not originate from external users. However, any system allowing end-users or untrusted sources to specify which elements should be selected via CSS syntax is vulnerable. This includes web applications with dynamic filtering features, APIs accepting selector parameters for data extraction, and automated scraping tools that allow user-defined query strings. The attack vector requires the attacker to provide a specific input pattern designed to trigger the quadratic backtracking behavior, making it an active exploitation scenario rather than a passive configuration error.
Mitigation strategies primarily involve upgrading to Soup Sieve version 2.9 or later, where this regular expression ambiguity has been resolved by restructuring the parsing logic to prevent excessive backtracking. For organizations unable to immediately upgrade, defensive coding practices should be implemented to validate and sanitize any user-supplied CSS selectors before passing them to the library. This may include length limits on selector strings or restricting allowed character sets in attribute values. Additionally, running these operations within isolated processes with strict CPU time limits can help contain potential denial-of-service impacts if an attack is attempted.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically the sub-category of Regular Expression Denial of Service (ReDoS). It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where attackers consume computational resources to degrade service availability. By understanding these classifications, security teams can better prioritize remediation efforts and monitor for similar patterns in other parts of their codebase that utilize complex regular expressions with user-controlled input.