- Severity: HIGH
- CVE: CVE-2026-126190
- Ecosystems: pip
- Packages: soupsieve
## Summary
Matching a selector that uses the descendant combinator (`a b`) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with `k` descendant combinators takes `O(n^(k+1))` time on a chain of `n` nested elements.
An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup’s `select()`, `select_one()`, `css.select()`, etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as `section div div`.
## Details
To match `a b`, Soup Sieve checks each element against `b` and then walks up through its ancestors looking for one that matches `a`. When the selector has more descendant combinators, the rest of the selector is tried again from each ancestor on that walk, and so on for every combinator. Nothing was reused between walks, so the same ancestors were matched against the same part of the selector over and over.
The worst case is when the leftmost part of the selector never matches, as in `section div div` against a document of nested “ with no “: every walk goes all the way to the root and no search can stop early.
### Timings
Example timings with `html.parser` on Soup Sieve 3.0.4 and 4.0, using a document of nested “ (5 bytes each) and no matches:
| Nesting depth | Input size | Selector | 3.0.4 | 4.0 |
| — | — | —…
Source: GitHub Security Advisories · 2026-11-13