Source: soupsieve Version: 2.8.4-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for soupsieve. CVE-2026-85999[0]: | Soup Sieve is a CSS selector library designed to be used with | Beautiful Soup 4. Prior to 2.9, selector_iter in | src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, | an end-anchored WSC whitespace-and-comment expression used with | search(), so the regular expression engine retries a greedy scan at | every starting offset. An attacker-controlled valid selector | containing a long internal whitespace run, or a selector containing | a long CSS comment run followed by another token, causes quadratic | CPU work before tokenization. User-controlled selectors can reach | the path through soupsieve.compile() and BeautifulSoup.select(), | while applications using only hard-coded selectors are unaffected. | This root cause is separate from the IDENTIFIER and VALUE | backtracking vulnerability because the cost occurs in | RE_WS_END.search during trimming rather than token matching. The | resulting CPU consumption can hold the Python GIL, exhaust workers, | and stall a service without causing memory corruption or code | execution. The issue is fixed in version 2.9. CVE-2026-86000[1]: | Soup Sieve is a CSS selector library designed to be used with | Beautiful Soup 4. Prior to 2.9, the selector parser in | src/soupsieve/css_parser.py defines IDENTIFIER with adjacent | quantified groups over overlapping character classes, and VALUE | embeds IDENTIFIER for attribute selectors. When an attacker- | controlled selector contains a long identifier or unquoted | attribute-value run followed by input that makes the overall match | fail, the regular expression engine explores quadratically many | splits between the overlapping groups. User-controlled selectors can | reach this path through soupsieve.compile(), soupsieve.select(), or | BeautifulSoup.select(), while applications using only hard-coded | selectors are unaffected. The resulting CPU consumption can hold the | Python GIL, exhaust application workers, and stall a service; | successful plain identifier matches are linear, and the issue does | not cause memory corruption or code execution. The issue is fixed in | version 2.9. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-85999 https://www.cve.org/CVERecord?id=CVE-2026-85999 https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f [1] https://security-tracker.debian.org/tracker/CVE-2026-86000 https://www.cve.org/CVERecord?id=CVE-2026-86000 https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c Please adjust the affected versions in the BTS as needed. Regards, Salvatore
