# CVE-2026-126190: Soup Sieve polynomial DoS in descendant combinator matching

Source: https://junglewise.ai/threats/cve-2026-126190-soup-sieve-is-a-css-selector-library-designed-to-be-used-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126190 · Severity: high · CVSS 7.5 · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 to parse and search HTML/XML documents. Prior to version 4.0, the library has a performance vulnerability where processing deeply nested documents with certain selector patterns causes CPU usage to grow polynomially with document depth, allowing an attacker to consume worker resources for extended periods by providing malicious HTML documents with simple selectors like "section div div div".

Technologies: [Facelessuser Soup Sieve](https://junglewise.ai/threats/technologies/soup-sieve), [soupsieve (PyPI)](https://junglewise.ai/threats/technologies/soupsieve). Vendors: [Facelessuser](https://junglewise.ai/threats/vendors/facelessuser), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-126190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126190 being exploited in the wild.

**How severe is CVE-2026-126190?** High severity, with a CVSS score of 7.5, published 12 November 2026.

**Which products and versions are affected?** Facelessuser Soup Sieve before 4.0; soupsieve (PyPI) < 4.0.0.

**Is there a fix for CVE-2026-126190?** Yes: fixed in 4.0. Until then: Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126190 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126190?** Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0

Selectors compiled with NOCACHE flag continue to use the uncached behavior; restrict CSS selector evaluation to trusted documents only until upgrading.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"},{"kind":"patched","at":"2026-11-03","note":"fix merged via PR #351"}]

## Technical details

The vulnerability is an algorithmic complexity denial of service (CWE-407) in the descendant combinator matching logic. When matching selectors with descendant combinators, the library repeatedly walks and re-evaluates the same ancestor elements without caching results, causing time complexity to grow as O(depth^combinators). The fix, implemented in version 4.0, caches ancestor match results per element to reduce complexity to linear in document size. Attack requires processing untrusted HTML/XML documents via select(), select_one(), or Beautiful Soup CSS APIs.

## Affected products

- facelessuser Soup Sieve before 4.0

## Identifiers

- CVE-2026-126190
- GHSA-mmhr-3c5m-f64f

## References

- [https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320](https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320)
- [https://github.com/facelessuser/soupsieve/pull/351](https://github.com/facelessuser/soupsieve/pull/351)

## Related threats

- [Soup Sieve recursion error in CSS pseudo-class parsing](https://junglewise.ai/threats/cve-2026-126193-soup-sieve-is-a-css-selector-library-for-beautiful-soup-from-0-4)
- [Soup Sieve ReDoS via general sibling combinator in :has()](https://junglewise.ai/threats/cve-2026-126192-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve CSS selector ReDoS via exponential backtracking](https://junglewise.ai/threats/cve-2026-126191-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve quadratic ReDoS in CSS selector matching](https://junglewise.ai/threats/cve-2026-126189-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve ReDoS in IDENTIFIER and VALUE selector patterns](https://junglewise.ai/threats/cve-2026-86000-soup-sieve-redos-in-identifier-and-value-selector-patterns)