{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/soup-sieve--4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:soup_sieve_project:soup_sieve:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Soup Sieve (\u003c 4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Soup Sieve"],"content_html":"\u003cp\u003eSoup Sieve is a CSS selector library commonly used with Beautiful Soup 4. The library contains an algorithmic complexity vulnerability in versions prior to 4.0, where improper handling of descendant combinators during CSS selector matching leads to excessive resource consumption. When processing deeply nested, attacker-influenced HTML or XML documents, the library repeatedly traverses ancestors, increasing the polynomial degree of the work required for each additional descendant combinator.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications that utilize the library's \u003ccode\u003eselect()\u003c/code\u003e or \u003ccode\u003eselect_one()\u003c/code\u003e methods, or other Beautiful Soup CSS APIs, to process untrusted documents can experience severe performance degradation or a denial-of-service. Attackers can leverage this to occupy worker processes for seconds or minutes, effectively stalling document processing capabilities. Selectors compiled with the \u003ccode\u003eNOCACHE\u003c/code\u003e flag remain susceptible to the original uncached, inefficient behavior.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Soup Sieve library to version 4.0 or later across all applications that process untrusted HTML or XML content.\u003c/li\u003e\n\u003cli\u003eAudit internal applications to identify those using \u003ccode\u003eselect()\u003c/code\u003e or \u003ccode\u003eselect_one()\u003c/code\u003e methods on input from external users.\u003c/li\u003e\n\u003cli\u003eFor environments where immediate patching is not possible, implement strict input validation to limit the depth and complexity of submitted HTML or XML documents before parsing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T20:49:57Z","date_published":"2026-11-12T20:49:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-soup-sieve-dos-cve-2026-126190/","summary":"Soup Sieve versions prior to 4.0 are vulnerable to an algorithmic complexity denial-of-service, where processing deeply nested, untrusted HTML or XML documents leads to excessive resource consumption and worker process exhaustion.","title":"Soup Sieve: Algorithmic complexity denial-of-service (CVE-2026-126190)","url":"https://feed.craftedsignal.io/briefs/2026-11-soup-sieve-dos-cve-2026-126190/"}],"language":"en","title":"CraftedSignal Threat Feed - Soup Sieve (\u003c 4.0)","version":"https://jsonfeed.org/version/1.1"}