{"id":"EM-20261113-U5YF","url":"https://cyber.eventmonitor.net/incident/EM-20261113-U5YF/soup-sieve-vulnerability-cve-2026-126190/","type":"cve","title":"Soup Sieve Vulnerability (CVE-2026-126190)","subtitle":"CVE-2026-126190","subject":"CVE-2026-126190","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-13T00:49:46.000Z","firstSignal":"2026-11-12T17:17:32.440Z","lastSignal":"2026-11-13T00:49:46.000Z","updated":"2026-11-13T01:40:17.673Z","revision":1,"life":[{"status":"Born","at":"2026-11-13T00:49:46.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-13T00:49:46.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-12T17:17:32.440Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-13T00:49:46.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261113-U5YF created."}],"stages":[{"name":"Disclosed","at":"2026-11-12T17:17:32.440Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-12T17:17:32.440Z","detail":"CVSS 7.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-12T17:17:32.440Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-126190 (CVSS 7.5)","text":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126190"},{"at":"2026-11-13T00:49:46.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-mmhr-3c5m-f64f / CVE-2026-126190: Soup Sieve: Polynomial-time denial of service in the descendant combinator","text":"pip:soupsieve","url":"https://github.com/advisories/GHSA-mmhr-3c5m-f64f"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-12T17:17:32.440","score":7.5,"severity":"HIGH","desc":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested…","product":"","seen":1794519258238},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}