A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by passing crafted CSS selectors to soupsieve.compile() or Beautiful Soup's select methods. The attack requires only about 300 bytes of input to cause a multi-second hang, with exponential backtracking time as input length increases. The vulnerability affects soupsieve versions from 3.11.2 up to but not including 3.25.2_2. A fix is available in version 3.25.2_2.