# CVE-2026-126193: Soup Sieve recursion error in CSS pseudo-class parsing

Source: https://junglewise.ai/threats/cve-2026-126193-soup-sieve-is-a-css-selector-library-for-beautiful-soup-from-0-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126193 · Severity: medium · CVSS 5.3 · Published 2026-11-12

Soup Sieve is a CSS selector library used by Beautiful Soup to parse web content. When processing deeply nested CSS pseudo-class selectors from untrusted sources, the library can hit Python's recursion limit and crash, causing the application to fail to process that request. While this is recoverable and does not crash the entire service, it allows attackers to trigger localized denials of service.

Technologies: [Facelessuser Soup Sieve](https://junglewise.ai/threats/technologies/soup-sieve). Vendors: [Facelessuser](https://junglewise.ai/threats/vendors/facelessuser).

## Quick answers

**Is CVE-2026-126193 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126193 being exploited in the wild.

**How severe is CVE-2026-126193?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** Facelessuser Soup Sieve 0.4 to 2.x.

**Is there a fix for CVE-2026-126193?** Yes: fixed in 3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126193 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126193?** Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0

## Technical details

A stack exhaustion vulnerability exists in Soup Sieve versions 0.4 through 2.x due to recursive parsing of deeply nested CSS pseudo-class selectors. An attacker providing a malicious selector string triggers RecursionError when the parser exceeds Python's recursion depth limit. The vulnerability requires the application to accept and parse untrusted selectors; the impact is denial of service per request rather than a persistent outage.

## Affected products

- facelessuser Soup Sieve 0.4 to 2.x

## Timeline

- 2026-11-12: disclosed
- 2026-09-26: patched: Fix merged via PR #306 (recursion elimination)

## References

- [https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee](https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee)
- [https://github.com/facelessuser/soupsieve/pull/306](https://github.com/facelessuser/soupsieve/pull/306)

## Related threats

- [Soup Sieve ReDoS via general sibling combinator in :has()](https://junglewise.ai/threats/cve-2026-126192-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve CSS selector ReDoS via exponential backtracking](https://junglewise.ai/threats/cve-2026-126191-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve polynomial DoS in descendant combinator matching](https://junglewise.ai/threats/cve-2026-126190-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve quadratic ReDoS in CSS selector matching](https://junglewise.ai/threats/cve-2026-126189-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [facelessuser soupsieve ReDoS in CSS selector parser](https://junglewise.ai/threats/cve-2026-49477-facelessuser-soupsieve-redos-in-css-selector-parser)