Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22149-1 advisory.

    - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex `RE_WS_END` can     lead to DoS       (bsc#1281119).
    - CVE-2026-86000: quadratic complexity when running the `IDENTIFIER` / `VALUE` selector sub-patterns can     lead to a DoS       (bsc#1281120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24267-1 advisory.

    - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex `RE_WS_END` can     lead to DoS       (bsc#1281119).
    - CVE-2026-86000: quadratic complexity when running the `IDENTIFIER` / `VALUE` selector sub-patterns can     lead to a DoS       (bsc#1281120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector
    parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping
    character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled
    selector contains a long identifier or unquoted attribute-value run followed by input that makes the
    overall match fail, the regular expression engine explores quadratically many splits between the
    overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(),
    soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are
    unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall
    a service; successful plain identifier matches are linear, and the issue does not cause memory corruption
    or code execution. The issue is fixed in version 2.9. (CVE-2026-86000)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector     parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping     character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled     selector contains a long identifier or unquoted attribute-value run followed by input that makes the     overall match fail, the regular expression engine explores quadratically many splits between the     overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(),     soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are     unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall     a service; successful plain identifier matches are linear, and the issue does not cause memory corruption     or code execution. The issue is fixed in version 2.9. (CVE-2026-86000)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371099	openSUSE 16 Security Update : python-soupsieve (openSUSE-SU-2026:22149-1)	Nessus	SuSE Local Security Checks	Local	medium
371096	SUSE SLES16 Security Update : python-soupsieve (SUSE-SU-2026:24267-1)	Nessus	SuSE Local Security Checks	Local	medium
457647	Echo: soupsieve: security update to 2.9.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457647	Echo: soupsieve: security update to 2.9.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
348293	Linux Distros Unpatched Vulnerability : CVE-2026-86000	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-86000

medium

Tenable Plugins

medium

medium

medium

medium

medium