Executive brief
Soup Sieve, a CSS selector library commonly used with Beautiful Soup 4 for web scraping and data processing, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted CSS selector that causes the system's processor to become overwhelmed, leading to significant performance degradation or a complete service outage. This issue is particularly impactful for web applications or APIs that allow users to input their own CSS selectors for data filtering.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `RE_VALUES` / `VALUE` regex pattern within `soupsieve/css_parser.py`. The vulnerability is triggered by catastrophic backtracking when the parser processes an attribute selector containing an unterminated quoted value (e.g., `[a="xxxx`). Because the regex engine attempts to match multiple overlapping alternation branches before failing, the processing time grows exponentially with the length of the input. A payload as small as 300 bytes can hang a thread for several seconds, allowing an unauthenticated remote attacker to exhaust server CPU resources. The issue is resolved in version 2.8.4 by fixing the inefficient attribute patterns.
Affected products
- facelessuser soupsieve < 2.8.4
Timeline
- 2026-05-24: patched: Version 2.8.4 released
- 2026-06-01: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: NVD publication date