Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-14T20:53:12 soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.

An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. Red Hat ships soupsieve as a dependency in multiple products including OpenShift, Ceph Storage, RHOAI, Satellite, Ansible Automation Platform, OpenStack Platform, CNV, Lightspeed, and various container images. There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) — an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk. Red Hat Hardened Images 2026-06-07T00:00:00Z RHSA-2026:23992 python-attrs-main-26.1.0-3.hum1 Red Hat Hardened Images 2026-07-01T00:00:00Z RHSA-2026:34119 python-rpds-py-main-2026.6.3-1.hum1 Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cuda-12.9-rhel9 Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Hardened Images Not affected python-urllib3 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Affected python-soupsieve Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat OpenStack Platform 17.1 Affected python-soupsieve Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Affected python-soupsieve https://www.cve.org/CVERecord?id=CVE-2026-49476 https://nvd.nist.gov/vuln/detail/CVE-2026-49476 https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39 https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x