CVE-2026-49477: CWE-400: Uncontrolled Resource Consumption in facelessuser soupsieve
CVE-2026-49477 is a high-severity vulnerability in the soupsieve CSS selector library used with Beautiful Soup 4. Versions prior to 2.8.4 contain a regular expression in the CSS selector parser that is vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value. This flaw allows an attacker who can supply untrusted CSS selector strings to cause CPU exhaustion and denial of service. The issue is fixed in version 2.8.4.
AI Analysis
Technical Summary
The vulnerability in soupsieve arises from a regular expression in soupsieve/css_parser.py that is susceptible to catastrophic backtracking when handling attribute selectors with unterminated quoted values. This can be triggered by passing crafted CSS selector strings to soupsieve.compile() or Beautiful Soup's .select() or .select_one() methods. The resulting uncontrolled resource consumption leads to CPU exhaustion and denial of service. The flaw is addressed in soupsieve version 2.8.4.
Potential Impact
An attacker able to supply untrusted CSS selector strings to soupsieve or Beautiful Soup can cause the application to consume excessive CPU resources, resulting in denial of service. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade soupsieve to version 2.8.4 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
CVE-2026-49477: CWE-400: Uncontrolled Resource Consumption in facelessuser soupsieve
Description
CVE-2026-49477 is a high-severity vulnerability in the soupsieve CSS selector library used with Beautiful Soup 4. Versions prior to 2.8.4 contain a regular expression in the CSS selector parser that is vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value. This flaw allows an attacker who can supply untrusted CSS selector strings to cause CPU exhaustion and denial of service. The issue is fixed in version 2.8.4.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in soupsieve arises from a regular expression in soupsieve/css_parser.py that is susceptible to catastrophic backtracking when handling attribute selectors with unterminated quoted values. This can be triggered by passing crafted CSS selector strings to soupsieve.compile() or Beautiful Soup's .select() or .select_one() methods. The resulting uncontrolled resource consumption leads to CPU exhaustion and denial of service. The flaw is addressed in soupsieve version 2.8.4.
Potential Impact
An attacker able to supply untrusted CSS selector strings to soupsieve or Beautiful Soup can cause the application to consume excessive CPU resources, resulting in denial of service. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade soupsieve to version 2.8.4 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-836r-79rf-4m37
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49477"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4fa9a168715ace437d3dcc
Added to database: 07/09/2026, 14:01:05 UTC
Last enriched: 07/23/2026, 20:59:53 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 112
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.