Is CVE-2026-126190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126190 being exploited in the wild.

How severe is CVE-2026-126190?

High severity, with a CVSS score of 7.5, published 12 November 2026.

Which products and versions are affected?

Facelessuser Soup Sieve before 4.0; soupsieve (PyPI) < 4.0.0.

Is there a fix for CVE-2026-126190?

Yes: fixed in 4.0. Until then: Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading. [{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126190 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126190?

Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126190: Soup Sieve polynomial DoS in descendant combinator matching

Q: Is there a fix for CVE-2026-126190?

Yes: fixed in 4.0. Until then: Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading. [{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-126190 · Severity: high · CVSS 7.5 · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 to parse and search HTML/XML documents. Prior to version 4.0, the library has a performance vulnerability where processing deeply nested documents with certain selector patterns causes CPU usage to grow polynomially with document depth, allowing an attacker to consume worker resources for extended periods by providing malicious HTML documents with simple selectors like "section div div div".

Technologies: Facelessuser Soup Sieve, soupsieve (PyPI). Vendors: Facelessuser, PyPI.

Quick answers

Is CVE-2026-126190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126190 being exploited in the wild.
How severe is CVE-2026-126190?: High severity, with a CVSS score of 7.5, published 12 November 2026.
Which products and versions are affected?: Facelessuser Soup Sieve before 4.0; soupsieve (PyPI) < 4.0.0.
Is there a fix for CVE-2026-126190?: Yes: fixed in 4.0. Until then: Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126190 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126190?: Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0

Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}]

Technical details

The vulnerability is an algorithmic complexity denial of service (CWE-407) in the descendant combinator matching logic. When matching selectors with descendant combinators, the library repeatedly walks and re-evaluates the same ancestor elements without caching results, causing time complexity to grow as O(depth^combinators). The fix, implemented in version 4.0, caches ancestor match results per element to reduce complexity to linear in document size. Attack requires processing untrusted HTML/XML documents via select(), select_one(), or Beautiful Soup CSS APIs.

Affected products

facelessuser Soup Sieve before 4.0

Identifiers

CVE-2026-126190
GHSA-mmhr-3c5m-f64f

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.