CVE-2026-85999
Description
A flaw was found in Soup Sieve, a CSS selector library. A remote attacker can provide a specially crafted CSS selector containing long whitespace or comment runs. This can cause excessive CPU consumption during selector trimming, leading to a Regular Expression Denial of Service (ReDoS) by stalling the service and exhausting system resources.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
