CVE-2026-49477

{
  "id": "CVE-2026-49477",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T21:17:02.007",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4."
    },
    {
      "lang": "es",
      "value": "Soup Sieve es una biblioteca de selectores CSS diseñada para ser utilizada con Beautiful Soup 4. Antes de la versión 2.8.4, el analizador de selectores CSS en soupsieve contiene una expresión regular vulnerable a retroceso catastrófico al procesar un selector de atributo con un valor entre comillas sin terminar en soupsieve/css_parser.py, permitiendo a un atacante que puede suministrar cadenas de selectores CSS no confiables a soupsieve.compile() o Beautiful Soup .select() / .select_one() causar agotamiento de CPU y denegación de servicio. Este problema está solucionado en la versión 2.8.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "facelessuser",
          "product": "soupsieve",
          "versions": [
            {
              "version": "< 2.8.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T14:49:25.096784Z",
          "id": "CVE-2026-49477",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:facelessuser:soup_sieve:*:*:*:*:*:beautiful_soup:*:*",
              "versionEndExcluding": "2.8.4",
              "matchCriteriaId": "6819C9CA-C98C-47D1-B9DE-E6C32A933427"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}