CVE-2026-126191

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0.

• CWE-1333

• https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e
• https://github.com/facelessuser/soupsieve/pull/300
• https://github.com/facelessuser/soupsieve/releases/tag/3.0
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126186Active Storage makes it simple to upload and reference files…8.8
• CVE-2026-126187React is a JavaScript library for building user interfaces. …9.5
• CVE-2026-126188Active Storage makes it simple to upload and reference files…3.7
• CVE-2026-126189Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-12619Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-126190Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-126192Soup Sieve is a CSS selector library designed to be used wit…6.3
• CVE-2026-126193Soup Sieve is a CSS selector library for Beautiful Soup. Fro…5.3
• CVE-2026-126196pgEdge Postgres MCP Server enables SQL queries against Postg…8.1
• CVE-2026-126197pgEdge Postgres MCP Server enables SQL queries against Postg…8.8
• CVE-2026-126198pgEdge Postgres MCP Server enables SQL queries against Postg…3.1
• CVE-2026-126199pgEdge Postgres MCP Server enables SQL queries against Postg…6.8