CyberRota Analysis
AI-GeneratedThe Soup Sieve library, used with Beautiful Soup 4, is vulnerable to a denial-of-service attack due to a regular expression flaw in its CSS selector parser that can lead to CPU exhaustion when processing untrusted attribute selectors with unterminated quoted values. This issue affects versions prior to 2.8.4, and users of the library should prioritize upgrading to the latest version to mitigate the risk of service disruption. Developers and organizations relying on Beautiful Soup for web scraping or HTML parsing should take immediate action to secure their applications against this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)