CVE-2026-85999: Soup Sieve polynomial-time ReDoS in whitespace trimming regex
CVE-2026-85999 · Severity: medium · CVSS 5.3 · Published 2026-09-17
Executive brief
Soup Sieve, a CSS selector parser used by BeautifulSoup for web scraping and HTML parsing, contains a denial-of-service vulnerability in its whitespace/comment trimming logic. An attacker can provide a valid CSS selector with a long run of whitespace or comments (e.g., a descendant combinator with thousands of spaces) to cause the parser to consume excessive CPU time—up to 10+ seconds for a ~20 KB selector—blocking the application from serving requests.
Technical details
The vulnerability is a polynomial-time regular expression denial of service (ReDoS) in the `RE_WS_END` regex pattern (`{WSC}*
Junglewise
), which trims trailing whitespace and comments before tokenizing. The pattern is not anchored at the start, so `.search()` retries the match at every string offset. When a long run of whitespace or CSS comments appears mid-selector (e.g., in a descendant combinator like `a` + many spaces + `b`), the greedy quantifier `*` consumes the entire run at each offset, fails on the `
Junglewise
anchor (because non-whitespace follows), and the regex engine backtracks—producing O(n²) complexity. The vulnerability triggers on perfectly valid selectors and requires only that an attacker can supply user-controlled CSS selectors to `soupsieve.compile()`, `soupsieve.select()`, or BeautifulSoup's `soup.select()`. No malformed input or parser error is necessary; the quadratic cost is inherent to the regex design in the normal parsing path.
Affected products
Isaac Muse Soup Sieve 2.8.4, 2.9, and likely earlier
Timeline
2026-09-17: disclosed: Vulnerability advisory published