CVE-2026-49476

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Uncontrolled Resource Consumption pada facelessuser soup sieve. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

28 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x exploit · advisory vendor
• https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39 patch
• https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 release notes