# CVE-2026-49476: facelessuser Soup Sieve denial of service via memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-49476-facelessuser-soup-sieve-denial-of-service-via-memory-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-49476 · Severity: high · CVSS 7.5 · Published 2026-07-14

Soup Sieve is a software library used by the popular Beautiful Soup tool to search and extract data from web pages using CSS selectors. A vulnerability in how it processes these selectors allows an attacker to crash a server or application by sending a specially crafted, small request that consumes massive amounts of system memory. This can lead to a total service outage (Denial of Service) for any application that allows users to provide their own search patterns.

Technologies: [Facelessuser Soup Sieve](https://junglewise.ai/threats/technologies/soup-sieve), [soupsieve (PyPI)](https://junglewise.ai/threats/technologies/soupsieve). Vendors: [Facelessuser](https://junglewise.ai/threats/vendors/facelessuser), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-49476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49476 being exploited in the wild.

**How severe is CVE-2026-49476?** High severity, with a CVSS score of 7.5, published 14 July 2026.

**Which products and versions are affected?** Facelessuser Soup Sieve < 2.8.4; soupsieve (PyPI) <= 2.8.3, ECOSYSTEM:introduced=0,fixed=2.8.4.

**Is there a fix for CVE-2026-49476?** Yes. soupsieve (PyPI): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49476 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49476?** Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- soupsieve (PyPI): upgrade to 2.8.4 or later

  ```sh
  pip install "soupsieve>=2.8.4"
  ```


## Technical details

A resource exhaustion vulnerability exists in the CSS selector parser of Soup Sieve (soupsieve/css_parser.py). The parser fails to limit the number of selectors in a comma-separated list, creating a complex object graph for every item. An attacker can provide a crafted selector string (e.g., a large list of single-character selectors) to functions like soupsieve.compile() or Beautiful Soup's .select() methods. This results in a high memory amplification ratio (e.g., a 500KB input triggering ~244MB of heap allocation), leading to memory exhaustion and process termination via OOM killers or MemoryError exceptions. The issue is resolved in version 2.8.4 by limiting the total number of selectors processed.

## Affected products

- facelessuser soupsieve < 2.8.4

## Identifiers

- CVE-2026-49476
- GHSA-2wc2-fm75-p42x
- PYSEC-2026-3071

## Timeline

- 2026-05-24: patched: Fix committed and version 2.8.4 released.
- 2026-06-01: advisory: GitHub Security Advisory published.
- 2026-07-14: disclosed: CVE published to NVD.

## References

- [https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39](https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39)
- [https://github.com/facelessuser/soupsieve/releases/tag/2.8.4](https://github.com/facelessuser/soupsieve/releases/tag/2.8.4)
- [https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x](https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x)

## Related threats

- [Soup Sieve recursion error in CSS pseudo-class parsing](https://junglewise.ai/threats/cve-2026-126193-soup-sieve-is-a-css-selector-library-for-beautiful-soup-from-0-4)
- [Soup Sieve ReDoS via general sibling combinator in :has()](https://junglewise.ai/threats/cve-2026-126192-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve CSS selector ReDoS via exponential backtracking](https://junglewise.ai/threats/cve-2026-126191-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve polynomial DoS in descendant combinator matching](https://junglewise.ai/threats/cve-2026-126190-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)
- [Soup Sieve quadratic ReDoS in CSS selector matching](https://junglewise.ai/threats/cve-2026-126189-soup-sieve-is-a-css-selector-library-designed-to-be-used-with)