CVE-2026-49477 Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser

High 7.5 Published 14 Jul 2026 Updated 21 Jul 2026

An attacker can cause CPU exhaustion and denial of service by supplying malicious CSS selector strings to the soupsieve library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-49477?

CVE-2026-49477 is a high-severity denial of service vulnerability in facelessuser soupsieve, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

Weakness: CWE-400, CWE-1333

Which versions are affected by CVE-2026-49477?

3 open source packages ship an affected version, including soupsieve. It affects 1 product.

Package	Affected	Fixed in
`soupsieve` PyPI	All versions	`2.8.4`
`soupsieve` PyPI	All versions	`2.8.4`
`soupsieve` PyPI	All versions	`2.8.4`

Products include Facelessuser Soup Sieve.

How do I fix CVE-2026-49477?

Upgrade soupsieve to 2.8.4 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-49477 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49477 exists.

CVE-2026-49476 Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve High 7.5

Sources

Also known as CLEANSTART-2026-DI63885, DEBIAN-CVE-2026-49477, ECHO-a29a-2b91-4618, GHSA-836r-79rf-4m37, MINI-5f4f-5wj2-954v, MINI-5pfr-qxr9-8qxw and 7 more.