Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9,
    selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC
    whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy
    scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace
    run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work
    before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and
    BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause
    is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in
    RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the
    Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The
    issue is fixed in version 2.9. (CVE-2026-85999)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9,     selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC     whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy     scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace     run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work     before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and     BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause     is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in     RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the     Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The     issue is fixed in version 2.9. (CVE-2026-85999)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464885	Echo: soupsieve: security update to 2.9.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464885	Echo: soupsieve: security update to 2.9.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
348304	Linux Distros Unpatched Vulnerability : CVE-2026-85999	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-85999

medium

Tenable Plugins

medium

medium

medium