The soupsieve CSS selector engine for Beautiful Soup 4 contains a regex in css_parser.py that is vulnerable to catastrophic backtracking when parsing attribute selectors with unterminated quoted values. The regex pattern attempts to match quoted strings but lacks proper anchoring or termination checks, causing exponential backtracking when the closing quote is missing. This results in CPU exhaustion and thread blocking for payloads as small as 300 bytes. The vulnerability affects soupsieve versions before 2.8.4 and can be triggered by passing untrusted CSS selectors to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods.

An attacker can cause a denial of service by exhausting CPU resources on any server-side Python application using vulnerable soupsieve versions to parse untrusted CSS selectors. The attack requires only a small payload (around 300 bytes) and causes the regex engine to hang for multiple seconds, blocking the thread. This can degrade service availability or cause application unresponsiveness. There is no memory exhaustion or data confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or user-supplied CSS selectors to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods. Consider input validation or limiting selector complexity to mitigate potential ReDoS attacks.