Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22149-1 advisory.

    - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex `RE_WS_END` can     lead to DoS       (bsc#1281119).
    - CVE-2026-86000: quadratic complexity when running the `IDENTIFIER` / `VALUE` selector sub-patterns can     lead to a DoS       (bsc#1281120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24267-1 advisory.

    - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex `RE_WS_END` can     lead to DoS       (bsc#1281119).
    - CVE-2026-86000: quadratic complexity when running the `IDENTIFIER` / `VALUE` selector sub-patterns can     lead to a DoS       (bsc#1281120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9,
    selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC
    whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy
    scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace
    run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work
    before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and
    BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause
    is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in
    RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the
    Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The
    issue is fixed in version 2.9. (CVE-2026-85999)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9,     selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC     whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy     scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace     run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work     before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and     BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause     is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in     RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the     Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The     issue is fixed in version 2.9. (CVE-2026-85999)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371099	openSUSE 16 Security Update : python-soupsieve (openSUSE-SU-2026:22149-1)	Nessus	SuSE Local Security Checks	Local	medium
371096	SUSE SLES16 Security Update : python-soupsieve (SUSE-SU-2026:24267-1)	Nessus	SuSE Local Security Checks	Local	medium
464885	Echo: soupsieve: security update to 2.9.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464885	Echo: soupsieve: security update to 2.9.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
348304	Linux Distros Unpatched Vulnerability : CVE-2026-85999	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-85999

medium

Tenable Plugins

medium

medium

medium

medium

medium