Soup Sieve: Polynomial-time denial of service in the descendant combinator (CVE-2026-126190)
Published Last modified Sources: EUVD, OSV, Hersteller, CVE.org
What is affected, what to do
Update Facelessuser Soupsieve to version 4.0.
- Affected
- Facelessuser Soupsieve
lt *..4.0
- Facelessuser Soupsieve
- Fixed in
- Facelessuser Soupsieve
4.0
- Facelessuser Soupsieve
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
7.5
XIEM Effective CVSS
Highest available CVSS rating from NVD and vendor data.
Source: Vendor (CNA), CVSS v3
7.5
CVSS v3
Severity High on the scale from 0 to 10.
Source: EUVD, OSV, Hersteller, CVE.org
—
EPSS score
No value is available for this vulnerability.
Show all metrics
- Severity
- High
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 67.50 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- no public PoC known
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 7.5 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 7.5
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- —
- Published
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-407
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Summary
Matching a selector that uses the descendant combinator (a b) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with k descendant combinators takes O(n^(k+1)) time on a chain of n nested elements.
An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup's select(), select_one(), css.select(), etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as section div div.
Details
To match a b, Soup Sieve checks each element against b and then walks up through its ancestors looking for one that matches a. When the selector has more descendant combinators, the rest of the selector is tried again from each ancestor on that walk, and so on for every combinator. Nothing was reused between walks, so the same ancestors were matched against the same part of the selector over and over.
The worst case is when the leftmost part of the selector never matches, as in section div div against a document of nested <div> with no <section>: every walk goes all the way to the root and no search can stop early.
Timings
Example timings with html.parser on Soup Sieve 3.0.4 and 4.0, using a document of nested <div> (5 bytes each) and no matches:
| Nesting depth | Input size | Selector | 3.0.4 | 4.0 |
|---|---|---|---|---|
| 2,000 | 10 KB | section div | 1.6 s | 0.05 s |
| 4,000 | 20 KB | section div | 5.1 s | 0.01 s |
| 400 | 2 KB | section div div | 6.7 s | < 0.01 s |
| 800 | 4 KB | section div div | 53.0 s | < 0.01 s |
| 100 | 0.5 KB | section div div div | 2.5 s | < 0.01 s |
| 200 | 1 KB | section div div div | 40.9 s | < 0.01 s |
None of these selectors use unusual syntax.
Proof of concept
import time
import bs4
import soupsieve as sv
soup = bs4.BeautifulSoup('<div>' * 200, 'html.parser')
t = time.process_time()
sv.select('section div div div', soup)
print(time.process_time() - t)
On affected versions, doubling the nesting depth multiplies the time by about 2^(k+1), where k is the number of descendant combinators: about 4x for section div, 8x for section div div, and 16x for section div div div.
Impact
Applications are affected if they run selectors with descendant combinators against documents that untrusted users can influence, such as scrapers, HTML sanitizers or filters, and services that process uploaded or fetched markup. Descendant combinators are among the most common parts of CSS selectors, and a document of about 1 KB is enough to tie up a worker for close to a minute. Applications that only run selectors against trusted documents are not affected.
Patches
Fixed in 4.0 by facelessuser/soupsieve#351. Whether an element is, or has an ancestor that is, a match for part of a selector depends only on its parent, so Soup Sieve now caches that result per element and relation for every element visited on the walk. Each descendant combinator is then linear in the size of the document. Results are unchanged, and ordinary documents are no slower.
Caching is enabled by default, so no changes are needed beyond upgrading. The NOCACHE flag is a temporary fallback for users who run into problems with caching, and it is planned for removal. It uses the old uncached matching, so selectors compiled with NOCACHE are still subject to polynomial time and shouldn't be used with descendant combinators on untrusted input.
Workarounds
If users can't upgrade:
- Use as few descendant combinators as they can in selectors that run on untrusted documents. Where the structure of the
document is known, the child combinator (
a > b) only looks at the parent and is not affected. - Limit the size and nesting depth of untrusted documents before selecting on them.
- Run selection on untrusted input with a time limit, for example in a worker process that can be stopped.
Source: ENISA EUVD, OSV (Open Source Vulnerabilities), GitHub Security Advisories, NVD (NIST), cvelistv5, CVE.org (MITRE)
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| facelessuser | soupsieve |
|
|
| pip | soupsieve |
|
|
| pypi | soupsieve |
|
|
Vendors and products
Weakness classes (CWE)
CWE-407Inefficient Algorithmic Complexity
Class
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Entry at MITRE CWE-407
References & sources
- github.comfacelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecd…x_refsource_MISC, euvd, web
- github.comfacelessuser/soupsieve/pull/351x_refsource_MISC, euvd, web
- github.comfacelessuser/soupsieve/releases/tag/4.0x_refsource_MISC, euvd, web
- github.comfacelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64fx_refsource_CONFIRM, euvd, web
- NVD (NIST)vuln/detail/CVE-2026-126190advisory, euvd
- github.comfacelessuser/soupsievepackage
Changes to this CVE
Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).
ReceivedGitHub
CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness type: CWE-407
Description added or changed
Show 8 original changes
Individual changes of this event as published by NVD Type Action Before After Description added —Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.CVSS added —AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness type (CWE) added —CWE-407Affected versions (publisher) added —New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/126xxx/CVE-2026-126190.json">CVE-2026-126190</a>Reference added —https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320Reference added —https://github.com/facelessuser/soupsieve/pull/351Reference added —https://github.com/facelessuser/soupsieve/releases/tag/4.0Reference added —https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64fSource identifier: security-advisories@github.com
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2026-126190"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-126190.svg?lang=en" alt="CVE-2026-126190 – NEOSEC Intel" height="20"></a>