CVE-2026-126193: Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack
Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Soup Sieveto a version that resolves this vulnerability.Fixed in 3.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Soup Sieve versions from 0.4 through versions before 3.0 are exposed when they accept CSS selectors from untrusted input and parse them. Applications that do not process attacker-controlled selectors are not identified as affected by the described attack path.
What does an attacker need to do to trigger the problem?
An attacker can submit a deeply nested CSS pseudo-class selector. No privileges or user interaction are required according to the supplied vector.
What is the expected impact if exploitation succeeds?
Parsing can exceed Python’s recursion limit and raise RecursionError, causing the affected request or task to fail if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service.
What can be done if upgrading is not immediately possible?
Avoid accepting untrusted CSS selectors, or ensure selector parsing errors such as RecursionError are handled so the failing request or task can be contained. Upgrade to Soup Sieve 3.0 to obtain the fix.