CVE-2026-126190

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126190
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126190.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126190
Aliases
Published
2026-11-12T16:54:14Z
Modified
2026-11-13T02:47:06Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Soup Sieve: Polynomial-time denial of service in the descendant combinator
Details

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126190.json"
}
References

Affected packages

Git / github.com/facelessuser/soupsieve

Affected ranges

Type
GIT
Repo
https://github.com/facelessuser/soupsieve
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ff1a5ce7e5addc31626d7b6053511fecdb4f6320
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "ff1a5ce7e5addc31626d7b6053511fecdb4f6320"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "4.0",
            "range": [
                {
                    "fixed": "ff1a5ce7e5addc31626d7b6053511fecdb4f6320"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
1.*
1.0.0
1.0.0b1
1.0.0b2
1.0.1
1.0.2
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.*
2.0.0
2.0.1
2.1.0
2.10
2.2
2.2.1
2.3
2.3.1
2.3.2
2.3.2.post1
2.4
2.4.1
2.5
2.6
2.7
2.8
2.8.1
2.8.2
2.8.3
2.8.4
2.9
2.9.1
2.9.2
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126190.json"