SUSE-SU-2026:5164-1: Security update for python-soupsieve

Q: Which systems are in scope for this update?

The update applies to python-soupsieve and python3-soupsieve in the SUSE Basesystem Module 15-SP7 (noarch).

Q: What input patterns are associated with the denial-of-service risk?

CVE-2026-85999 is triggered by quadratic behavior in the RE_WS_END whitespace/comment trimming regex. CVE-2026-86000 involves quadratic behavior in the IDENTIFIER and VALUE selector sub-patterns.

Q: How can I determine whether a system needs the update?

Check whether python-soupsieve or python3-soupsieve is installed from the SUSE Basesystem Module 15-SP7. The advisory identifies these packages as affected by the update.

Published Nov 10, 2026

Updated

This update for python-soupsieve fixes the following issues:

- CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS (bsc#1281119). - CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS (bsc#1281120).

Other sources

This update for python-soupsieve fixes the following issues: CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS (bsc#1281119). CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS (bsc#1281120).

— SUSE

Affected Software

3 affected componentsFixes available

suse/python-soupsieve<1.9.5-150200.3.6.1

1.9.5-150200.3.6.1

All of the following

SUSE Basesystem Module 15-SP7 (noarch)

suse/python3-soupsieve<1.9.5-150200.3.6.1

1.9.5-150200.3.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/python-soupsieve to a version that resolves this vulnerability.
Fixed in 1.9.5-150200.3.6.1
Upgrade
Upgrade suse/python3-soupsieve to a version that resolves this vulnerability.
Fixed in 1.9.5-150200.3.6.1
Upgrade
Upgrade python-soupsieve to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP7-2026-5164

Event History

Nov 10, 2026

Advisory Published

via OSV·09:43 AM

Data Sourced

via OSV·09:43 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:43 AM

Data Sourced

via SUSE·09:43 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are in scope for this update?

The update applies to python-soupsieve and python3-soupsieve in the SUSE Basesystem Module 15-SP7 (noarch).

What input patterns are associated with the denial-of-service risk?

CVE-2026-85999 is triggered by quadratic behavior in the RE_WS_END whitespace/comment trimming regex. CVE-2026-86000 involves quadratic behavior in the IDENTIFIER and VALUE selector sub-patterns.

How can I determine whether a system needs the update?

Check whether python-soupsieve or python3-soupsieve is installed from the SUSE Basesystem Module 15-SP7. The advisory identifies these packages as affected by the update.

SUSE-SU-2026:5164-1: Security update for python-soupsieve

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are in scope for this update?

What input patterns are associated with the denial-of-service risk?

How can I determine whether a system needs the update?

Company

Resources

Contact

Frequently Asked Questions

Which systems are in scope for this update?

What input patterns are associated with the denial-of-service risk?

How can I determine whether a system needs the update?