CVE-2026-86000— Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Quick assessment
Affected
facelessuser soupsieve
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Soup Sieve 是一个专为 Beautiful Soup 4 设计的 CSS 选择器库。在 2.9 版本之前，位于 中的选择器解析器将 （标识符）定义为相邻的、字符类存在重叠的带量词分组，并且 （值）在属性选择器中嵌入了 。当攻击者可控的选择器中包含一个长标识符或未加引号的属性值序列，且后续输入导致整体匹配失败时，正则表达式引擎会在这些重叠分组之间进行数量呈二次方增长的拆分探索。用户可控的选择器可通过 、 或 到达此代码路径，而仅使用硬编码选择器的应用不受影响。由此产生的 CPU 消耗会占用 Python 的
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86000
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Source: CVE Program / CVE List V5
Vulnerability Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| facelessuser | soupsieve | < 2.9 | - |
|
II. Public POCs for CVE-2026-86000
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86000
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86000 (1)
Vendor Advisories for CVE-2026-86000 (1)
Vendor Pages for CVE-2026-86000 (1)
-
🔗 Release 2.9 · facelessuser/soupsieve · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: facelessuser
-
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/ -
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets -
CVE-2026-67422
pymdown-extensions: Exponential-backtracking ReDoS in caret, -
CVE-2026-46338
PyMdown Extensions: Regression in pymdownx.snippets reintrod -
CVE-2026-49476
Soup Sieve: Memory Exhaustion via Large Comma-Separated Sele
Same weakness: CWE-400
-
CVE-2026-85718
AsyncHttpClient: Connection permit leak on TLS handshake fai -
CVE-2026-85721
AsyncHttpClient: Unbounded HTTP/1.1 response decompression e -
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/ -
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription proc -
CVE-2026-92879
vgmstream mus_acm.c parse_mus resource consumption
V. Comments for CVE-2026-86000
No comments yet