Threats tagged 'brew-flexget-cve-2026-85999'

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END, which is used during CSS selector parsing. The regex is unanchored at the start and uses .search(), causing quadratic time complexity (O(n²)) on valid selectors with long whitespace or comment runs not exactly at the string end. This can cause significant CPU delays (e.g., ~10 seconds for a 20 KB selector). The issue affects soupsieve versions >=3.17.7 and <3.19.30 and is exploitable when user-controlled selectors are passed to soupsieve or BeautifulSoup's select methods. A fix is available in version 3.19.30.