GHSA-8jvp-3x96-xpqw: Soup Sieve: Quadratic-time denial of service when matching `:has()`
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), selectone(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Soup Sieveto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service risk?
Applications that run Soup Sieve selectors containing :has() against attacker-influenced HTML or XML are exposed, including use through select(), select_one(), or Beautiful Soup CSS APIs. Processing only trusted documents is not affected.
What input and selector conditions are needed to trigger the issue?
An attacker needs to supply deeply nested or wide HTML or XML that is evaluated with a selector using :has(). Ordinary fixed selectors can be affected; the selector does not need to be attacker-controlled.
What is the operational impact of successful exploitation?
Quadratic selector matching can occupy a worker for seconds or minutes, causing a denial of service. The reported impact is availability only, with no confidentiality or integrity impact.
Does the fix apply when selectors are compiled with NOCACHE?
No. Selectors compiled with NOCACHE continue to use the old uncached behavior.
How can I determine whether an application is affected?
Review whether the application uses Soup Sieve versions before 4.0.1 and evaluates :has() selectors against untrusted HTML or XML. Also check for selectors compiled with NOCACHE, which retain the old behavior.