CVE-2026-126189

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126189

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126189.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126189

Aliases

GHSA-8jvp-3x96-xpqw

Published

2026-11-12T16:53:00Z

Modified

2026-11-13T02:47:07Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Soup Sieve: Quadratic-time denial of service when matching `:has()`

Details

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126189.json"
}

References

Affected packages

Git / github.com/facelessuser/soupsieve

Affected ranges

Type

GIT

Repo

https://github.com/facelessuser/soupsieve

Events

Introduced

Fixed

5185d19ca8e20789601fce96665288208baceca3

Fixed

0469c148f5501ec2127e0d65b77c2a1c395fa379

Fixed

305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "0469c148f5501ec2127e0d65b77c2a1c395fa379"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "4.0.1",
            "range": [
                {
                    "fixed": "5185d19ca8e20789601fce96665288208baceca3"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.4.0

0.5.0

0.5.1

0.5.2

0.5.3

0.6.0

1.*

1.0.0

1.0.0b1

1.0.0b2

1.0.1

1.0.2

1.1.0

1.2.0

1.2.1

1.3.0

1.3.1

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

2.*

2.0.0

2.0.1

2.1.0

2.10

2.2

2.2.1

2.3

2.3.1

2.3.2

2.3.2.post1

2.4

2.4.1

2.5

2.6

2.7

2.8

2.8.1

2.8.2

2.8.3

2.8.4

2.9

2.9.1

2.9.2

3.*

3.0

3.0.1

3.0.2

3.0.3

3.0.4

4.*

4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126189.json"