A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause significant CPU consumption and thread blocking with a small payload of about 300 bytes. The issue affects soupsieve versions from 3.4.2 up to but not including 3.9.2_1 and has been assigned CVE-2026-49477. A fix is available in version 3.9.2_1.