Threats tagged 'brew-bbot-cve-2026-126192'

CVE-2026-126192 describes a performance-related vulnerability in Soup Sieve when using a CSS selector with a general sibling combinator inside :has(), such as div:has(a ~ b). This selector runs in quadratic time relative to the number of sibling elements, causing significant CPU delays when processing untrusted HTML with many siblings. The issue arises because the implementation performs nested scans without short-circuiting when the right-hand sibling is absent. This can stall applications that evaluate such selectors on attacker-controlled HTML. The vulnerability affects Soup Sieve versions from 1.1.0.2090 up to but not including 3.0.2_1. A fix is available in version 3.0.2_1. Mitigations include careful use of :has() selectors, avoiding anchors with many children, and restricting inner selectors to combinators like > or + to limit traversal.