Soup Sieve: Algorithmic complexity denial-of-service (CVE-2026-126190)

Soup Sieve is a CSS selector library commonly used with Beautiful Soup 4. The library contains an algorithmic complexity vulnerability in versions prior to 4.0, where improper handling of descendant combinators during CSS selector matching leads to excessive resource consumption. When processing deeply nested, attacker-influenced HTML or XML documents, the library repeatedly traverses ancestors, increasing the polynomial degree of the work required for each additional descendant combinator.

Impact

Applications that utilize the library's select() or select_one() methods, or other Beautiful Soup CSS APIs, to process untrusted documents can experience severe performance degradation or a denial-of-service. Attackers can leverage this to occupy worker processes for seconds or minutes, effectively stalling document processing capabilities. Selectors compiled with the NOCACHE flag remain susceptible to the original uncached, inefficient behavior.

Recommendation

• Update the Soup Sieve library to version 4.0 or later across all applications that process untrusted HTML or XML content.
• Audit internal applications to identify those using select() or select_one() methods on input from external users.
• For environments where immediate patching is not possible, implement strict input validation to limit the depth and complexity of submitted HTML or XML documents before parsing.