CVE-2026-86000 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Attackers can cause denial of service via CPU exhaustion in Soup Sieve by submitting crafted CSS selectors that trigger quadratic regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86000?
CVE-2026-86000 is a medium-severity denial of service vulnerability in facelessuser soupsieve, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.
Which versions are affected by CVE-2026-86000?
3 open source packages ship an affected version, including soupsieve.
| Package | Affected | Fixed in |
|---|---|---|
soupsieve PyPI | All versions | 2.9.0 |
soupsieve PyPI | All versions | 2.9.0 |
soupsieve PyPI | All versions | 2.9.0 |
How do I fix CVE-2026-86000?
Upgrade soupsieve to 2.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-86000 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86000 exists.
Sources
Also known as AZL-103325, CLEANSTART-2026-PS59368, CLEANSTART-2026-YC00032, DEBIAN-CVE-2026-86000, ECHO-7d38-76d0-5832, GHSA-gjv8-xp57-g29c and 9 more.