CVE-2026-126191 json
Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
published 9d ago modified 14h ago also EUVD-2026-124551 , GHSA-6655-6qjp-jx7x
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0.
Patch / fix
- pypi soupsieve 3.0.2
Is CVE-2026-126191 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 15h ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-13).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | soupsieve | <3.0.2 |
3.0.2 |
Affected products
- facelessuser soupsieve
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/facelessuser/soupsieve/pull/300
web
-
github.com
/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e
web
-
github.com
/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x
web, advisory
-
github.com
/facelessuser/soupsieve/releases/tag/3.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-126191
advisory
-
github.com
/facelessuser/soupsieve
package
Sources
- CVE List CVE-2026-126191
- GitHub Advisory GHSA-6655-6qjp-jx7x
- NVD CVE-2026-126191
- Maintainer advisory GHSA-6655-6qjp-jx7x
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of facelessuser/soupsieve published their own advisory on GitHub. Reviewed sources take precedence over it.