Cloudanix VulnDB

CVE-2026-49477

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jul 14, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a tool that reads CSS selectors lets attackers feed it bad input that locks up the computer and stops services from working.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Regular expression catastrophic backtracking in the CSS attribute selector parser when given an unterminated quoted value, resulting in CPU exhaustion and denial of service.

Why it matters to the business

Attackers can render affected services unavailable by exhausting CPU resources; the issue affects systems using the vulnerable library for untrusted CSS input and carries an available exploit with stable low EPSS.

How an attack unfolds

An attacker supplies a crafted CSS selector containing an unterminated quoted attribute value to soupsieve.compile() or Beautiful Soup .select()/.select_one(); the parser enters exponential backtracking, consuming CPU until the process is unresponsive. The presence of a publicly available exploit increases immediate risk.

How to fix it

Upgrade soupsieve to version 2.8.4 or newer. For Red Hat systems, apply the fixed package python-rpds-py-main 2026.6.3-1.hum1 (RHSA-2026:34119) and restart affected services.

How to confirm the fix worked

Confirm the installed soupsieve version is at least 2.8.4; test the parser with a selector containing an unterminated quoted attribute and verify it returns promptly without excessive CPU usage.

Typical attack path

  1. Identify an endpoint or API that accepts untrusted CSS selector strings and passes them to soupsieve or Beautiful Soup
  2. Craft a selector with an unterminated quoted attribute value designed to trigger backtracking
  3. Submit the selector via the exposed interface
  4. Observe sustained high CPU usage leading to service degradation or crash

How to detect it

Inspect application and system logs for repeated calls to soupsieve parsing functions with malformed selectors; correlate with sudden sustained high CPU on Python worker processes; review web or API request logs for unusual selector patterns.

What your security team should do

  • Apply the vendor-supplied update to soupsieve 2.8.4 or the Red Hat fixed package immediately
  • Add input validation or sanitization around any code paths that compile untrusted CSS selectors
  • Monitor for anomalous CPU spikes in Python processes handling selector parsing
  • Review dependency trees to identify all downstream packages relying on the vulnerable version

The record

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities