# CVE-2026-126189: Soup Sieve quadratic ReDoS in CSS selector matching

Source: https://junglewise.ai/threats/cve-2026-126189-soup-sieve-is-a-css-selector-library-designed-to-be-used-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126189 · Severity: medium · CVSS 5.3 · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 to parse and search HTML/XML documents. Versions before 4.0.1 suffer from algorithmic inefficiency when processing deeply nested or wide HTML, where the :has() selector causes repeated tree searches. An attacker can craft malicious HTML that occupies a worker thread for seconds or minutes, causing a denial of service against applications that process untrusted documents.

Technologies: [Facelessuser Soup Sieve](https://junglewise.ai/threats/technologies/soup-sieve). Vendors: [Facelessuser](https://junglewise.ai/threats/vendors/facelessuser).

## Quick answers

**Is CVE-2026-126189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126189 being exploited in the wild.

**How severe is CVE-2026-126189?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** Facelessuser Soup Sieve before 4.0.1.

**Is there a fix for CVE-2026-126189?** Yes: fixed in 4.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126189 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126189?** Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.1

## Technical details

The vulnerability is a quadratic time complexity issue in :has() pseudo-class matching, where descendant subtrees are repeatedly searched for each candidate and parent elements containing :has(> ...) are reevaluated for each child. Attack vectors include network input of untrusted HTML/XML documents to applications using select(), select_one(), or Beautiful Soup CSS APIs. The fix implements caching of descendant match results to avoid redundant evaluations; selectors compiled with NOCACHE retain the vulnerable uncached behavior.

## Affected products

- facelessuser Soup Sieve before 4.0.1

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379](https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379)
- [https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44](https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44)

## Related threats

- [Soup Sieve recursion error in CSS pseudo-class parsing](https://junglewise.ai/threats/cve-2026-126193-soup-sieve-is-a-css-selector-library-for-beautiful-soup-from-0-4)
- [Soup Sieve ReDoS via general sibling combinator in :has()](https://junglewise.ai/threats/cve-2026-126192-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve CSS selector ReDoS via exponential backtracking](https://junglewise.ai/threats/cve-2026-126191-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve polynomial DoS in descendant combinator matching](https://junglewise.ai/threats/cve-2026-126190-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [facelessuser soupsieve ReDoS in CSS selector parser](https://junglewise.ai/threats/cve-2026-49477-facelessuser-soupsieve-redos-in-css-selector-parser)