The soupsieve CSS parser allocates approximately 976 bytes of heap memory per selector when compiling comma-separated selector lists. It does not limit the number of selectors, so a large input string with many selectors (e.g., 250,000 'a' selectors separated by commas) causes the parser to allocate hundreds of megabytes of memory from a relatively small input (~500 KB). This unbounded memory allocation can lead to memory exhaustion and denial of service in applications using soupsieve.compile() or Beautiful Soup's .select() and .select_one() methods with user-supplied selectors. The attack surface includes any server-side Python application that accepts user input for CSS selectors. The amplification ratio of memory allocated to input size is approximately 488x. The vulnerability is tracked as CVE-2026-49476 and affects soupsieve versions before 2.8.4.

An attacker can cause denial of service by exhausting available memory on servers running vulnerable soupsieve versions. This can lead to container OOM kills, swap thrashing on physical servers, or Python process termination via MemoryError exceptions. The attack requires no authentication or user interaction and can be tuned to exhaust specific memory limits. Multiple concurrent exploit attempts can amplify the impact. This affects any application that compiles user-supplied CSS selectors using soupsieve or Beautiful Soup's selector methods.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or user-supplied CSS selectors to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods. Implement input validation or limits on selector list size to mitigate memory exhaustion risks.