Threats tagged 'brew-onion-location-cve-2026-126192'

CVE-2026-126192 describes a performance issue in Soup Sieve when using a CSS selector with a general sibling combinator inside :has(), such as div:has(a ~ b). This selector causes quadratic time complexity in the number of sibling elements when matched against untrusted HTML, potentially stalling the process for minutes on relatively small inputs. The issue arises because the implementation must scan many sibling elements repeatedly without short-circuiting. This can lead to denial of service by CPU exhaustion if untrusted HTML is processed with such selectors. The vulnerability affects Soup Sieve versions starting from 0.1.0. Mitigations include avoiding such selectors on untrusted input, limiting the use of :has() with general sibling combinators, and applying timeouts or input filtering.