Threats tagged 'brew-pferd-cve-2026-85999'

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex `RE_WS_END`. The regex is used unanchored with `.search()`, causing quadratic time complexity (O(n²)) on valid CSS selectors with long whitespace or comment runs. This can stall the interpreter for seconds on large inputs. The issue affects soupsieve versions from 3.4.2 up to but not including 3.9.3 and is fixed in 3.9.3.