[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
soupsieve	3.0.4 → 4.0

---

Soup Sieve: Polynomial-time denial of service in the descendant combinator

CVE-2026-126190 / GHSA-mmhr-3c5m-f64f

More information

Details

Summary

Matching a selector that uses the descendant combinator (a b) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with k descendant combinators takes O(n^(k+1)) time on a chain of n nested elements.

An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup's select(), select_one(), css.select(), etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as section div div.

Details

To match a b, Soup Sieve checks each element against b and then walks up through its ancestors looking for one that matches a. When the selector has more descendant combinators, the rest of the selector is tried again from each ancestor on that walk, and so on for every combinator. Nothing was reused between walks, so the same ancestors were matched against the same part of the selector over and over.

The worst case is when the leftmost part of the selector never matches, as in section div div against a document of nested <div> with no <section>: every walk goes all the way to the root and no search can stop early.

Timings

Example timings with html.parser on Soup Sieve 3.0.4 and 4.0, using a document of nested <div> (5 bytes each) and no matches:

Nesting depth	Input size	Selector	3.0.4	4.0
2,000	10 KB	section div	1.6 s	0.05 s
4,000	20 KB	section div	5.1 s	0.01 s
400	2 KB	section div div	6.7 s	< 0.01 s
800	4 KB	section div div	53.0 s	< 0.01 s
100	0.5 KB	section div div div	2.5 s	< 0.01 s
200	1 KB	section div div div	40.9 s	< 0.01 s

None of these selectors use unusual syntax.

Proof of concept

import time
import bs4
import soupsieve as sv

soup = bs4.BeautifulSoup('<div>' * 200, 'html.parser')
t = time.process_time()
sv.select('section div div div', soup)
print(time.process_time() - t)

On affected versions, doubling the nesting depth multiplies the time by about 2^(k+1), where k is the number of descendant combinators: about 4x for section div, 8x for section div div, and 16x for section div div div.

Impact

Applications are affected if they run selectors with descendant combinators against documents that untrusted users can influence, such as scrapers, HTML sanitizers or filters, and services that process uploaded or fetched markup. Descendant combinators are among the most common parts of CSS selectors, and a document of about 1 KB is enough to tie up a worker for close to a minute. Applications that only run selectors against trusted documents are not affected.

Patches

Fixed in 4.0 by facelessuser/soupsieve#351. Whether an element is, or has an ancestor that is, a match for part of a selector depends only on its parent, so Soup Sieve now caches that result per element and relation for every element visited on the walk. Each descendant combinator is then linear in the size of the document. Results are unchanged, and ordinary documents are no slower.

Caching is enabled by default, so no changes are needed beyond upgrading. The NOCACHE flag is a temporary fallback for users who run into problems with caching, and it is planned for removal. It uses the old uncached matching, so selectors compiled with NOCACHE are still subject to polynomial time and shouldn't be used with descendant combinators on untrusted input.

Workarounds

If users can't upgrade:

• Use as few descendant combinators as they can in selectors that run on untrusted documents. Where the structure of the
  document is known, the child combinator (a > b) only looks at the parent and is not affected.
• Limit the size and nesting depth of untrusted documents before selecting on them.
• Run selection on untrusted input with a time limit, for example in a worker process that can be stopped.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f
• https://nvd.nist.gov/vuln/detail/CVE-2026-126190
• https://github.com/facelessuser/soupsieve/pull/351
• https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320
• https://github.com/facelessuser/soupsieve/releases/tag/4.0
• https://github.com/advisories/GHSA-mmhr-3c5m-f64f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

facelessuser/soupsieve (soupsieve)

v4.0

Compare Source

4.0

• BREAK: The contents of an HTML template are no longer treated as part of the document. Selectors do not
  descend into a template, and elements inside one can't see beyond it, which also applies to pseudo-classes such
  as :lang(), :disabled, and :default. select and filter will still reach the contents of a template when
  they are called on the template itself, for example soup.template.select('p'). See the
  FAQ for more information.
• BREAK: The contents of an iframe are no longer treated as a separate document, as they are not one in a
  browser. Elements in an iframe are normal children, so :root does not match them, and :default,
  :indeterminate, :checked, :dir(), :lang(), and :read-write treat them like any other element. Recent
  versions of html.parser, lxml, and html5lib all escape the contents of an iframe like a browser does, so
  this mostly affects XHTML, Python versions that still don't escape such content in their specific html.parser,
  and elements added to an iframe by hand. :-soup-contains() now also includes the escaped text in an iframe.
  See the FAQ for more information.
• NEW: Update :disabled and :enabled to treat option and optgroup elements inside a disabled select as
  disabled, following a recent HTML specification update.
• FIX: Fix the subsequent-sibling combinator and :has(~ ...) never matching top level elements of a fragment
  that has no root element, unless caching was disabled.
• FIX: :indeterminate now treats a radio button group without a form as extending across the whole document
  instead of the top level element that contains it, and it no longer ignores radio buttons at the top level.
• FIX: Fix :default to treat a button with a missing or invalid type, and an input with type="image",
  as submit buttons.
• FIX: Fix :in-range and :out-of-range raising TypeError when the document contains an input without a
  type attribute.
• FIX: :read-write (and :read-only) now treat contenteditable="plaintext-only" elements as editing hosts and
  match the editable elements inside an editing host, following the nearest contenteditable state.
• FIX: :read-write (and :read-only) now ignore contenteditable on non-HTML elements, such as an SVG
  foreignObject, as the attribute only applies to HTML elements. Such elements inherit the state of their parent.
• FIX: :checked now only matches the last radio button with a checked attribute in a radio button group, as
  in a browser, where a group is the radio buttons with the same name and form, including the form attribute.
  :default still matches all of them, and the contents of a template are unaffected as they are not connected.
• FIX: :dir() and :defined no longer affect the rest of the selector list they are in. Previously, a selector
  list that used either of them could not have its combinators cross an iframe, ignored the specified namespaces,
  and matched nothing in XML, not even the parts that didn't use them. They still do not match in XML, but
  :not(:dir(ltr)) and :not(:defined) now do.
• FIX: :default and :indeterminate now honor the form attribute, which can associate a submit button or
  radio button with a form it is not in, or leave it without a form. It is ignored in a template, as in the HTML
  specification. Submit buttons outside of a form can now be its default button.
• FIX: :default, :checked, and :indeterminate now handle a form inside a form like a browser. In HTML, a
  browser ignores the nested form and takes its end tag for that of the parent, which matters for parsers that keep
  the nested form, such as html.parser. In XHTML and in a template, nested forms are real forms.
• FIX: :checked now matches the option that a browser would select. Without multiple, that is only the
  last option with a selected attribute in a select, and if there are none and the select shows a single
  option, the first option that is not disabled. :default still only considers the selected attribute.
• FIX: Fix [attribute!=value] excluding values that only start with the specified value, and in XML documents,
  type values that contain a newline.
• FIX: Match the values of every attribute that the HTML specification lists as ASCII case insensitive (rel,
  method, lang, dir, ...) without ASCII case sensitivity on HTML elements in HTML documents, not just type.
  Non-HTML elements are matched case sensitively.
• FIX: :dir() now matches non-HTML elements, such as SVG and MathML, by the direction they inherit from their
  parent (the dir attribute only applies to HTML elements), and HTML elements inside them, such as in an SVG
  foreignObject, by the direction of their ancestors.
• FIX: Fix :dir() ignoring the value of an input with dir="auto" and a missing or empty type.
• FIX: :dir() now uses a table generated from Unicode 18 instead of unicodedata, so results no longer depend
  on the Unicode version of the Python in use, and unassigned code points use their default direction.
• FIX: :dir() now uses the value of an input with dir="auto" when type is hidden, password, submit,
  reset, or button, as the HTML specification does.
• FIX: dir="auto" and bdi now analyze the text of non-HTML elements, such as SVG and MathML, and only ignore
  HTML elements such as script, style, and bdi. The text directly in an iframe is analyzed as well, and the
  contents of a template, which are not part of the document, are not.
• FIX: :dir() no longer lets the contents of a template inherit direction from the template or its
  ancestors, as they are not part of the document. They are left to right unless they specify otherwise.
• FIX: :dir() now matches a bdi element that is the root by its text instead of assuming left to right.
• FIX: :dir() now treats any element without a parent element as left to right, not just the root. Before,
  all but the first top level element of a fragment parsed with html.parser never matched.
• FIX: :dir() now accepts any identifier, as CSS requires, including escaped ones. Values other than ltr and
  rtl do not match anything.
• FIX: Respect namespaces provided by the parser when the root is not an HTML element, such as an svg element
  extracted from an html5lib document. Previously every element in such a tree was treated as an HTML element,
  which affected namespace selectors, namespaced attributes, and HTML specific pseudo-classes.
• FIX: Fix :lang() treating an element with an empty lang or xml:lang attribute as having the language of
  a tagged ancestor.
• FIX: Cache forms without a default button when matching :default to avoid quadratic time on forms with
  many non-default submit candidates.
• FIX: Fix :in-range and :out-of-range matching elements whose value, min, or max has a trailing newline;
  per HTML, such values are not valid, so they are treated like a missing value and cannot be out of range.
• FIX: Fix :in-range and :out-of-range raising ValueError when a date, month, week, or local date and
  time input has a year with more digits than Python will convert; such a year is now treated as invalid.
• FIX: Fix :in-range and :out-of-range not recognizing a datetime-local value, min, or max that uses a
  single space instead of T to separate the date and time.
• FIX: Search a form only once for checked radio buttons when matching :indeterminate to avoid quadratic time
  on forms with many radio button groups.
• FIX: :lang() now uses the lang attribute of SVG elements, as the HTML specification does (with xml:lang
  taking precedence). Previously only xml:lang was considered for elements outside the HTML namespace.
• FIX: :defined no longer matches HTML elements with an is attribute (customized built-in elements), which,
  like custom elements, are undefined until they are registered.
• FIX: Cache the index of each child when matching the general sibling combinator (a ~ b and :has(~ b)) to
  avoid quadratic time when the first matching sibling is far into a long list of siblings.
• FIX: Match attribute values with the i modifier using ASCII case insensitivity.
• FIX: Treat an input with an unknown type, such as type="foo", as a text input in :placeholder-shown,
  :read-write, :read-only and :dir(), as an invalid type is in the Text state in the HTML specification.
• FIX: Fix :enabled and :disabled never matching input elements with type="hidden".
• FIX: :required no longer matches input elements of types the required attribute does not apply to
  (hidden, range, color, submit, image, reset and button). Like in browsers, they match :optional.
• FIX: Cache whether an element is or has a matching ancestor when matching the descendant combinator (a b) to
  avoid time that grows with the depth of the document to the power of the number of combinators.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.