{"vulnerability": "CVE-2026-85999", "sightings": [{"uuid": "d191a5dd-39ed-4c82-8365-2fe4bc764aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85999", "type": "published-proof-of-concept", "source": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f", "content": "", "creation_timestamp": "2026-09-17T22:35:13.240034Z"}, {"uuid": "c7663126-bdc7-40ec-9b91-ebcc4f2ab40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85999", "type": "seen", "source": "https://gist.github.com/alon710/320920418b1280f455d87d486f8b865e", "content": "# CVE-2026-85999: CVE-2026-85999: Regular Expression Denial of Service (ReDoS) in Soup Sieve css_parser.py\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85999\n\n## Summary\nA polynomial-time Regular Expression Denial of Service (ReDoS) vulnerability in Soup Sieve versions prior to 2.9 allows remote unauthenticated attackers to cause CPU exhaustion and thread-pool denial of service. The vulnerability resides in the trailing whitespace and comment preprocessing step of the CSS parser. An attacker can trigger quadratic backtracking by submitting a crafted CSS selector string containing a long run of internal spaces or comments terminated by a non-matching token. This blocks the Python Global Interpreter Lock (GIL) and halts worker threads.\n\n## TL;DR\nA vulnerable unanchored regular expression in Soup Sieve's CSS parser allows unauthenticated remote attackers to trigger quadratic CPU exhaustion (ReDoS) and application denial of service by submitting a crafted CSS selector containing long runs of internal whitespace or comments. This issue is resolved in version 2.9.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: Not Available\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing BeautifulSoup 4 with Soup Sieve versions prior to 2.9 for CSS selector queries.\n- Python-based web scrapers, parsers, and browser-emulators processing dynamic CSS queries.\n- **soupsieve**: < 2.9 (Fixed in: `2.9`)\n\n## Mitigation\n\n- Upgrade to Soup Sieve version 2.9 or higher.\n- Implement length validation on user-controlled CSS selector inputs.\n- Sanitize input selectors by compressing multiple spaces and stripping comments prior to processing.\n\n**Remediation Steps:**\n1. Identify instances of the soupsieve library in project dependency files (e.g., requirements.txt, pyproject.toml).\n2. Update the dependency version constraint to at least soupsieve>=2.9.\n3. Deploy the updated dependency packages to testing environments to verify compatibility.\n4. Execute the application performance regression tests to confirm ReDoS mitigations are active.\n5. Push the verified patch to production deployments.\n\n## References\n\n- [GitHub Security Advisory GHSA-j934-xhv5-fg8f](https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f)\n- [CVE Record CVE-2026-85999](https://www.cve.org/CVERecord?id=CVE-2026-85999)\n- [NVD Entry CVE-2026-85999](https://nvd.nist.gov/vuln/detail/CVE-2026-85999)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85999) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T06:30:57.079173Z"}]}