Threats tagged 'brew-pferd-cve-2026-86000'

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing due to a quadratic-time regex backtracking issue in the IDENTIFIER and VALUE sub-patterns. This flaw can cause the regex engine to consume excessive CPU time when processing specially crafted selectors that fail to match, such as unterminated attribute values or invalid trailing characters. The vulnerability is exploitable when user-controlled CSS selectors are passed to soupsieve or BeautifulSoup's select methods. It affects soupsieve versions from 3.4.2 up to but not including 3.9.3. A fix is available in version 3.9.3.