Threats tagged 'brew-flexget-cve-2026-49476'

The soupsieve CSS selector parser used by Beautiful Soup 4 and Flexget allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted CSS selector string with many comma-separated items, causing the parser to consume excessive heap memory and leading to denial of service via memory exhaustion. This affects applications that pass user-supplied CSS selectors to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods. The vulnerability is fixed in Flexget version 3.19.22.