Is CVE-2026-49477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49477 being exploited in the wild.

How severe is CVE-2026-49477?

High severity, with a CVSS score of 7.5, published 14 July 2026.

Which products and versions are affected?

Facelessuser Soup Sieve < 2.8.4; soupsieve (PyPI) <= 2.8.3, ECOSYSTEM:introduced=0,fixed=2.8.4.

Is there a fix for CVE-2026-49477?

Yes. soupsieve (PyPI): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49477 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49477?

Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49477: facelessuser soupsieve ReDoS in CSS selector parser

Q: Is there a fix for CVE-2026-49477?

Yes. soupsieve (PyPI): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49477 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49477?

Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49477 · Severity: high · CVSS 7.5 · Published 2026-07-14

Soup Sieve, a CSS selector library commonly used with Beautiful Soup 4 for web scraping and data processing, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted CSS selector that causes the system's processor to become overwhelmed, leading to significant performance degradation or a complete service outage. This issue is particularly impactful for web applications or APIs that allow users to input their own CSS selectors for data filtering.

Technologies: Facelessuser Soup Sieve, soupsieve (PyPI). Vendors: Facelessuser, PyPI.

Quick answers

Is CVE-2026-49477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49477 being exploited in the wild.
How severe is CVE-2026-49477?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: Facelessuser Soup Sieve < 2.8.4; soupsieve (PyPI) <= 2.8.3, ECOSYSTEM:introduced=0,fixed=2.8.4.
Is there a fix for CVE-2026-49477?: Yes. soupsieve (PyPI): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49477 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49477?: Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

soupsieve (PyPI): upgrade to 2.8.4 or later
```
pip install "soupsieve>=2.8.4"
```

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `RE_VALUES` / `VALUE` regex pattern within `soupsieve/css_parser.py`. The vulnerability is triggered by catastrophic backtracking when the parser processes an attribute selector containing an unterminated quoted value (e.g., `[a="xxxx`). Because the regex engine attempts to match multiple overlapping alternation branches before failing, the processing time grows exponentially with the length of the input. A payload as small as 300 bytes can hang a thread for several seconds, allowing an unauthenticated remote attacker to exhaust server CPU resources. The issue is resolved in version 2.8.4 by fixing the inefficient attribute patterns.

Affected products

facelessuser soupsieve < 2.8.4

Identifiers

CVE-2026-49477
GHSA-836r-79rf-4m37
PYSEC-2026-3072

Timeline

2026-05-24: patched: Version 2.8.4 released
2026-06-01: advisory: GitHub Security Advisory published
2026-07-14: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.