CyberRota Analysis
AI-GeneratedThe Soup Sieve library, used with Beautiful Soup 4, is vulnerable to a denial-of-service attack due to unbounded memory allocation when processing large comma-separated selector lists prior to version 2.8.4. An attacker can exploit this vulnerability by supplying a crafted selector string, potentially leading to significant memory consumption and service disruption. Developers and organizations utilizing Beautiful Soup 4 should prioritize upgrading to version 2.8.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)