facelessuser soupsieve up to 2.8.3 CSS selector parser soupsieve.compile heap-based overflow

Summaryinfo

A vulnerability marked as problematic has been reported in facelessuser soupsieve up to 2.8.3. This affects the function soupsieve.compile of the component CSS selector parser. This manipulation causes heap-based overflow. This vulnerability is tracked as CVE-2026-49476. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in facelessuser soupsieve up to 2.8.3. Affected by this vulnerability is the function soupsieve.compile of the component CSS selector parser. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability. The summary by CVE is:

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-49476 since 05/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 2.8.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• facelessuser

Name

• soupsieve

Version

• 2.8.0
• 2.8.1
• 2.8.2
• 2.8.3

Website

• Product: https://github.com/facelessuser/soupsieve/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion