CVE-2026-85999— Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Quick assessment
Affected
facelessuser soupsieve
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Soup Sieve 是一个为 BeautifulSoup 4 设计的 CSS 选择器库。在 2.9 版本之前， 中的 函数使用以结尾为锚点的、用于 的 （一个匹配末尾空白符和注释的正则表达式）对原始选择器进行裁剪。这导致正则引擎在每个起始偏移量上都会重试贪婪扫描，从而产生二次方级的 CPU 开销。如果攻击者可控的合法选择器中包含长段的内部空白符，或者包含长 CSS 注释后紧跟另一个标记，就会在词法分析（tokenization）之前引发二次方级的 CPU 消耗。通过 和 ，用户可控的选择器可以触发该路径；而仅使用
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85999
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Source: CVE Program / CVE List V5
Vulnerability Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| facelessuser | soupsieve | < 2.9 | - |
|
II. Public POCs for CVE-2026-85999
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85999
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85999 (1)
Vendor Pages for CVE-2026-85999 (1)
-
🔗 Release 2.9 · facelessuser/soupsieve · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: facelessuser
-
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER -
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets -
CVE-2026-67422
pymdown-extensions: Exponential-backtracking ReDoS in caret, -
CVE-2026-46338
PyMdown Extensions: Regression in pymdownx.snippets reintrod -
CVE-2026-49476
Soup Sieve: Memory Exhaustion via Large Comma-Separated Sele
Same weakness: CWE-400
-
CVE-2026-85718
AsyncHttpClient: Connection permit leak on TLS handshake fai -
CVE-2026-85721
AsyncHttpClient: Unbounded HTTP/1.1 response decompression e -
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER -
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription proc -
CVE-2026-92879
vgmstream mus_acm.c parse_mus resource consumption
V. Comments for CVE-2026-85999
No comments yet