Threats tagged 'brew-flexget-cve-2026-86000'

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw causes quadratic-time regex backtracking when parsing certain crafted selectors that fail to match, such as unterminated attribute values or identifiers followed by invalid characters. This can stall the interpreter for seconds to minutes depending on input size. The vulnerability is exploitable when user-controlled CSS selectors are passed to soupsieve or BeautifulSoup's select methods. Fixed in version 3.19.30 of the affected product.