CVE-2026-49476: Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve
Vulnerability summary
CVE-2026-49476 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in facelessuser soup_sieve. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.64% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSoupsieve
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard22 products
- airflow-2< 2.11.2-r22
- datadog-agent-7.71-core-integrations< 7.71.2-r31
- datadog-agent-7.72-core-integrations< 7.72.4-r33
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r23
Wolfi11 products
- datadog-agent-7.72-core-integrations< 7.72.4-r33
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r23
- datadog-agent-7.75-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.76< 7.76.3-r41
Facelessuser2 products
- soup_sieve< 2.8.4
- soupsieve< 2.8.4
Debian1 product
- soupsieveAll versions (No fix recorded) | < 2.8.4-1
PyPI1 product
- soupsieve< 2.8.4
Ubuntu1 product
- soupsieveAll versions (No fix recorded)
6 vendors · 38 products
References
11 links- github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42xX Refsource CONFIRMWEBREPORTAdvisoryExploitVendor Advisory
- github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39X Refsource MISCREPORTFIXPatch
- pypi.org/project/soupsievePACKAGE
