CVE-2026-49476: facelessuser Soup Sieve denial of service via memory exhaustion

CVE-2026-49476 · Severity: high · CVSS 7.5 · Published 2026-07-14

Soup Sieve is a software library used by the popular Beautiful Soup tool to search and extract data from web pages using CSS selectors. A vulnerability in how it processes these selectors allows an attacker to crash a server or application by sending a specially crafted, small request that consumes massive amounts of system memory. This can lead to a total service outage (Denial of Service) for any application that allows users to provide their own search patterns.

Technologies: Facelessuser Soup Sieve, soupsieve (PyPI). Vendors: Facelessuser, PyPI.

Quick answers

Is CVE-2026-49476 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49476 being exploited in the wild.
How severe is CVE-2026-49476?
High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?
Facelessuser Soup Sieve < 2.8.4; soupsieve (PyPI) <= 2.8.3, ECOSYSTEM:introduced=0,fixed=2.8.4.
Is there a fix for CVE-2026-49476?
Yes. soupsieve (PyPI): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49476 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49476?
Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • soupsieve (PyPI): upgrade to 2.8.4 or later
    pip install "soupsieve>=2.8.4"

Technical details

A resource exhaustion vulnerability exists in the CSS selector parser of Soup Sieve (soupsieve/css_parser.py). The parser fails to limit the number of selectors in a comma-separated list, creating a complex object graph for every item. An attacker can provide a crafted selector string (e.g., a large list of single-character selectors) to functions like soupsieve.compile() or Beautiful Soup's .select() methods. This results in a high memory amplification ratio (e.g., a 500KB input triggering ~244MB of heap allocation), leading to memory exhaustion and process termination via OOM killers or MemoryError exceptions. The issue is resolved in version 2.8.4 by limiting the total number of selectors processed.

Affected products

  • facelessuser soupsieve < 2.8.4

Identifiers

  • CVE-2026-49476
  • GHSA-2wc2-fm75-p42x
  • PYSEC-2026-3071

Timeline

  • 2026-05-24: patched: Fix committed and version 2.8.4 released.
  • 2026-06-01: advisory: GitHub Security Advisory published.
  • 2026-07-14: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.