Executive brief
Soup Sieve is a software library used by the popular Beautiful Soup tool to search and extract data from web pages using CSS selectors. A vulnerability in how it processes these selectors allows an attacker to crash a server or application by sending a specially crafted, small request that consumes massive amounts of system memory. This can lead to a total service outage (Denial of Service) for any application that allows users to provide their own search patterns.
Technical details
A resource exhaustion vulnerability exists in the CSS selector parser of Soup Sieve (soupsieve/css_parser.py). The parser fails to limit the number of selectors in a comma-separated list, creating a complex object graph for every item. An attacker can provide a crafted selector string (e.g., a large list of single-character selectors) to functions like soupsieve.compile() or Beautiful Soup's .select() methods. This results in a high memory amplification ratio (e.g., a 500KB input triggering ~244MB of heap allocation), leading to memory exhaustion and process termination via OOM killers or MemoryError exceptions. The issue is resolved in version 2.8.4 by limiting the total number of selectors processed.
Affected products
- facelessuser soupsieve < 2.8.4
Timeline
- 2026-05-24: patched: Fix committed and version 2.8.4 released.
- 2026-06-01: advisory: GitHub Security Advisory published.
- 2026-07-14: disclosed: CVE published to NVD.