UBUNTU-CVE-2026-126189: Medium severity ubuntu/soupsieve vulnerability
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), selectone(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.1
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications that use Soup Sieve CSS selection APIs, including select(), select_one(), or Beautiful Soup CSS APIs, against attacker-influenced HTML or XML are exposed. Processing only trusted documents is not affected.
Does exploitation require an attacker to control the CSS selector?
No. Ordinary fixed selectors can be affected when they are applied to untrusted documents. The attacker needs to provide crafted deeply nested or wide HTML or XML that triggers costly :has() matching behavior.
What is the operational impact of a successful attack?
An attacker can cause quadratic selector matching that occupies a worker for seconds or minutes. The stated impact is availability degradation rather than confidentiality or integrity loss.
Are all selector compilation modes fixed by upgrading?
Version 4.0.1 fixes the issue, but selectors compiled with NOCACHE continue to use the old uncached behavior. Review whether the application explicitly compiles selectors with NOCACHE.