CVE-2026-49476

What it actually does

The CSS selector parser allocates unbounded heap memory when processing large comma-separated selector lists supplied to compile() or select()/select_one(), exhausting resources and causing denial of service.

Why it matters to the business

Attackers can remotely disrupt availability of applications that parse untrusted CSS selectors, leading to service outages and degraded performance with minimal attacker effort; the issue affects Red Hat packages with a specific fix available.

How an attack unfolds

An attacker crafts a small selector string containing thousands of comma-separated selectors and passes it to soupsieve.compile() or Beautiful Soup .select() methods; the parser allocates hundreds of megabytes per list entry until memory pressure triggers denial of service. Public exploit code exists and the flaw has been available for over three months.

How to fix it

Upgrade soupsieve to version 2.8.4 or later. For Red Hat systems running python-rpds-py-main, apply the package update to 2026.6.3-1.hum1 (RHSA-2026:34119) or newer.

How to confirm the fix worked

Confirm the installed soupsieve version is 2.8.4 or higher; test compilation of a large comma-separated selector list and verify memory usage remains bounded.

Typical attack path

1. Identify an application endpoint or API that accepts user-controlled CSS selector strings
2. Craft a compact payload consisting of a long comma-separated selector list
3. Submit the payload via soupsieve.compile() or Beautiful Soup .select()/select_one() calls
4. Observe repeated large memory allocations leading to OOM or severe slowdown

How to detect it

Review application logs and process monitors for sudden spikes in memory consumption coinciding with selector parsing calls; inspect request logs for unusually long comma-delimited strings passed to selector methods.

What your security team should do

• Immediately upgrade affected Red Hat packages to the listed fixed version
• Add input-size limits or sanitization around any user-supplied selector strings
• Monitor memory usage and process restarts on services using Beautiful Soup or soupsieve
• Review dependency trees for downstream consumers of the vulnerable library