CVE-2026-126193

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126193

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126193.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126193

Aliases

GHSA-7g44-g9rc-x53w

Published

2026-11-12T17:12:02Z

Modified

2026-11-13T02:47:25Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack

Details

Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126193.json"
}

References

Affected packages

Git / github.com/facelessuser/soupsieve

Affected ranges

Type

GIT

Repo

https://github.com/facelessuser/soupsieve

Events

Introduced

ef375447b4e5cd4f234a84f858d48450559a6ecb

Fixed

e39e4e7fa57d693da8d1f2422a7c9a9c7a6d5cc7

Fixed

52de12f157a373614ad0f486d434551c5a4378ee

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.4"
                },
                {
                    "fixed": "3.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "52de12f157a373614ad0f486d434551c5a4378ee"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "3.0",
            "range": [
                {
                    "fixed": "e39e4e7fa57d693da8d1f2422a7c9a9c7a6d5cc7"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.4.0

0.5.0

0.5.1

0.5.2

0.5.3

0.6.0

1.*

1.0.0

1.0.0b1

1.0.0b2

1.0.1

1.0.2

1.1.0

1.2.0

1.2.1

1.3.0

1.3.1

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

2.*

2.0.0

2.0.1

2.1.0

2.10

2.2

2.2.1

2.3

2.3.1

2.3.2

2.3.2.post1

2.4

2.4.1

2.5

2.6

2.7

2.8

2.8.1

2.8.2

2.8.3

2.8.4

2.9

2.9.1

2.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126193.json"