CVE-2026-126190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126190", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T20:07:44.957Z", "datePublished": "2026-11-12T16:54:14.644Z", "dateUpdated": "2026-11-12T16:54:14.644Z"}, "containers": {"cna": {"title": "Soup Sieve: Polynomial-time denial of service in the descendant combinator", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"}, {"name": "https://github.com/facelessuser/soupsieve/pull/351", "tags": ["x_refsource_MISC"], "url": "https://github.com/facelessuser/soupsieve/pull/351"}, {"name": "https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320", "tags": ["x_refsource_MISC"], "url": "https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"}, {"name": "https://github.com/facelessuser/soupsieve/releases/tag/4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/facelessuser/soupsieve/releases/tag/4.0"}], "affected": [{"vendor": "facelessuser", "product": "soupsieve", "versions": [{"version": "< 4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-12T16:54:14.644Z"}, "descriptions": [{"lang": "en", "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."}], "source": {"advisory": "GHSA-mmhr-3c5m-f64f", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "soupsieve", "vendor": "facelessuser", "versions": [{"status": "affected", "version": "< 4.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."}], "id": "CVE-2026-126190", "lastModified": "2026-11-12T19:09:06.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-12T17:17:32.440", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"}, {"source": "security-advisories@github.com", "url": "https://github.com/facelessuser/soupsieve/pull/351"}, {"source": "security-advisories@github.com", "url": "https://github.com/facelessuser/soupsieve/releases/tag/4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "soupsieve", "source": "cna", "vendor": "facelessuser"}, "product": "soupsieve", "vendor": "facelessuser"}], "created": "2026-11-13T01:15:12.332587+00:00", "updated": "2026-11-13T15:30:03.974326+00:00", "vendors": ["facelessuser", "facelessuser$PRODUCT$soupsieve"]}