CVE-2026-126189: Soup Sieve: Quadratic-time denial of service when matching `:has()`
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), selectone(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Soup Sieveto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications that run Soup Sieve selectors containing :has() against attacker-influenced HTML or XML are exposed, including when using select(), select_one(), or Beautiful Soup CSS APIs with ordinary fixed selectors. Applications that process only trusted documents are not affected.
What does an attacker need to do to trigger the denial of service?
An attacker needs to supply a deeply nested or wide HTML or XML document that is processed with a selector using :has(). No authentication or user interaction is required according to the provided vector.
What should be done if upgrading cannot happen immediately?
Avoid applying selectors containing :has() to untrusted documents until Soup Sieve can be updated. Restricting processing to trusted documents also avoids the affected scenario.
Are selectors compiled with NOCACHE protected by the fix?
No. Selectors compiled with NOCACHE continue to use the old uncached behavior.
What version fixes the issue?
The issue is fixed in Soup Sieve version 4.0.1.