Most recent entries from all

BREW-adr-viewer-CVE-2026-49477 — Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Affected: Homebrew: adr-viewer

### Summary

The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.

To be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.

Any application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.

### Details

**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern

The soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`"value"` or `'value'`) and unquoted identifiers. The regex contains alternation branches for:

1. Double-quoted strings: `"[^"\\]*(?:\\.[^"\\]*)*"` 2. Single-quoted strings: `'[^'\\]*(?:\\.[^'\\]*)*'` 3. Unquoted identifiers

When an attribute selector contains an **unterminated quoted value** - e.g., `[a="xxxx...` (opening `"` but no closing `"`) -” the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and at…

certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1094

Withdrawn: CLEANSTART-2026-BC02149 — Security fixes in airflow-3 3.1.8-r6

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...

EUVD-2026-339159

fkie_cve-2026-49477

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

GHSA-836r-79rf-4m37 — Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Affected: PyPI: soupsieve

### Summary

To be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.

Any application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.

### Details

**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern

1. Double-quoted strings: `"[^"\\]*(?:\\.[^"\\]*)*"` 2. Single-quoted strings: `'[^'\\]*(?:\\.[^'\\]*)*'` 3. Unquoted identifiers

OESA-2026-3619 — python-soupsieve security update

Affected: openEuler:22.03-LTS-SP4: python-soupsieve

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. It aims to provide selecting, matching, and filtering using modern CSS selectors. Soup Sieve currently provides selectors from the CSS level 1 specifications up through the latest CSS level 4 drafts and beyond (though some are not yet implemented). Security Fix(es):

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.(CVE-2026-49476)

openSUSE-SU-2026:21342-1 — Security update for python-soupsieve

Security update for python-soupsieve

PYSEC-2026-3072 — Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Affected: PyPI: soupsieve

### Summary

To be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.

Any application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.

### Details

**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern

1. Double-quoted strings: `"[^"\\]*(?:\\.[^"\\]*)*"` 2. Single-quoted strings: `'[^'\\]*(?:\\.[^'\\]*)*'` 3. Unquoted identifiers

RHSA-2026:34119 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers python-idna: idna: Denial of Service via specially crafted long inputs python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings

SUSE-SU-2026:22660-1 — Security update for python-soupsieve

Security update for python-soupsieve

UBUNTU-CVE-2026-49477

Affected: Ubuntu:20.04:LTS: soupsieve, Ubuntu:22.04:LTS: soupsieve, Ubuntu:24.04:LTS: soupsieve, Ubuntu:26.04:LTS: soupsieve