{"vulnerability": "CVE-2026-86000", "sightings": [{"uuid": "74334abb-af60-450e-bb05-7055f35a82ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86000", "type": "published-proof-of-concept", "source": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c", "content": "", "creation_timestamp": "2026-09-17T22:35:11.513920Z"}, {"uuid": "5e642962-04f1-4ad8-ab8a-dd5d71d20f27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86000", "type": "seen", "source": "https://gist.github.com/alon710/28e39e82ccb12ea34e715caa280614a0", "content": "# CVE-2026-86000: CVE-2026-86000: Polynomial-Time Regular Expression Denial of Service in Soup Sieve Selector Parser\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86000\n\n## Summary\nA regular expression denial of service (ReDoS) vulnerability in Soup Sieve prior to version 2.9 allows remote attackers to cause CPU exhaustion and service disruption. The issue lies within the definition of the IDENTIFIER and VALUE selector sub-patterns in the CSS parser component, which uses overlapping adjacent quantified groups. When parsing long, crafted, or unclosed CSS selectors, backtracking-based regular expression engines experience quadratic performance degradation. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected.\n\n## TL;DR\nUnauthenticated remote attackers can cause denial of service (CPU exhaustion) via crafted CSS selectors in Soup Sieve's parser before version 2.9.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: Not Available\n- **Primary Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Soup Sieve\n- Beautiful Soup 4 (via select method)\n- **soupsieve**: < 2.9 (Fixed in: `2.9`)\n\n## Mitigation\n\n- Upgrade Soup Sieve to version 2.9 or newer to completely resolve the inefficient regex pattern.\n- Sanitize and limit the length of untrusted CSS selectors accepted from users before parsing.\n- Isolate untrusted document and selector parsing tasks to sub-processes with strict timeouts.\n\n**Remediation Steps:**\n1. Identify instances of the soupsieve package in your environment using dependency scanners or command-line tools: pip show soupsieve\n2. Update the package in your requirements.txt, setup.py, or Pipfile to point to version 2.9 or higher: pip install -U soupsieve\n3. Implement an input length validator in application code paths that compile arbitrary CSS selectors, rejecting any strings longer than 128 characters.\n4. Run parsing workflows inside a multiprocessing pool or celery tasks with short time-limits to prevent single-process worker exhaustion.\n\n## References\n\n- [GitHub Security Advisory GHSA-gjv8-xp57-g29c](https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c)\n- [Official Fix Commit ce44e499](https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef)\n- [Official Release Tag (v2.9)](https://github.com/facelessuser/soupsieve/releases/tag/2.9)\n- [NVD Advisory Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-86000)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-86000)\n- [OSV Machine-Readable Vulnerability Registry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86000.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86000) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T05:31:29.909044Z"}]}