# CVE-2026-126192: Soup Sieve ReDoS via general sibling combinator in :has()

Source: https://junglewise.ai/threats/cve-2026-126192-soup-sieve-is-a-css-selector-library-designed-to-be-used-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126192 · Severity: medium · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 for parsing HTML documents. When applications process untrusted HTML with certain developer-authored selectors containing the general sibling combinator inside :has(), the library performs excessive repetitive scanning, causing a single worker thread to hang for minutes on even small documents. This can lead to denial of service attacks against web scraping applications or HTML processing services.

Technologies: [Facelessuser Soup Sieve](https://junglewise.ai/threats/technologies/soup-sieve), [soupsieve (PyPI)](https://junglewise.ai/threats/technologies/soupsieve). Vendors: [Facelessuser](https://junglewise.ai/threats/vendors/facelessuser), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-126192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126192 being exploited in the wild.

**How severe is CVE-2026-126192?** Medium severity, published 12 November 2026.

**Which products and versions are affected?** Facelessuser Soup Sieve before 2.10; soupsieve (PyPI) <= 2.9.2.

**Is there a fix for CVE-2026-126192?** Yes: fixed in 2.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126192 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126192?** Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.10

## Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) equivalent in CSS selector matching: selectors like div:has(a ~ b) with an absent right-hand side trigger quadratic-time scanning of candidate elements' following siblings. The flaw affects the general sibling combinator (~) when used inside :has() pseudo-class matching in Soup Sieve versions prior to 2.10; the adjacent sibling form (+) and trusted-only document processing are not vulnerable in the same way. The fix implements caching to eliminate the redundant scans.

## Affected products

- facelessuser Soup Sieve before 2.10

## Identifiers

- CVE-2026-126192
- GHSA-4j63-6c4x-wfg4

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0](https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0)
- [https://github.com/facelessuser/soupsieve/pull/304](https://github.com/facelessuser/soupsieve/pull/304)

## Related threats

- [Soup Sieve recursion error in CSS pseudo-class parsing](https://junglewise.ai/threats/cve-2026-126193-soup-sieve-is-a-css-selector-library-for-beautiful-soup-from-0-4)
- [Soup Sieve CSS selector ReDoS via exponential backtracking](https://junglewise.ai/threats/cve-2026-126191-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve polynomial DoS in descendant combinator matching](https://junglewise.ai/threats/cve-2026-126190-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve quadratic ReDoS in CSS selector matching](https://junglewise.ai/threats/cve-2026-126189-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve ReDoS in IDENTIFIER and VALUE selector patterns](https://junglewise.ai/threats/cve-2026-86000-soup-sieve-redos-in-identifier-and-value-selector-patterns)