Threats tagged 'ghsa-7g44-g9rc-x53w'

Soup Sieve's CSS selector parser has an uncontrolled recursion vulnerability when parsing nested pseudo-class selectors such as :is(), :not(), :where(), and :has(). An attacker supplying a deeply nested selector string (about 330 levels) can cause a RecursionError by exceeding Python's recursion limit. This leads to a denial of service for the individual request or task parsing the selector. The issue affects versions from 0.4 up to but not including 3.0.2, with a fix available in 3.0.2. No confidentiality or integrity impact is present, and the failure occurs before document matching.