CVE-2026-49476

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

• CWE-400
• CWE-770

• https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39Patch
• https://github.com/facelessuser/soupsieve/releases/tag/2.8.4Release Notes
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42xExploit, Vendor Advisory
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42xExploit, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Jul 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49467Pingvin Share X is a secure and easy self-hosted file sharin…8.8
• CVE-2026-49468LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.8
• CVE-2026-4947Addressed a potential insecure direct object reference (IDOR…7.1
• CVE-2026-49471Serena is a powerful MCP toolkit for coding that provides se…8.3
• CVE-2026-49472FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-49475FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-49477Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-4948A flaw was found in firewalld. A local unprivileged user can…5.5
• CVE-2026-49482ClipBucket v5 is an open source video sharing platform. Prio…4.3
• CVE-2026-49485HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-49486The Apache Airflow FTP provider's `FTPSHook.get_conn()` crea…7.5
• CVE-2026-49487In Apache Airflow before 3.3.0, the REST API task-instance d…6.5