{
  "affected": [
    {
      "affectedData": [
        {
          "product": "soupsieve",
          "vendor": "facelessuser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4."
    }
  ],
  "id": "CVE-2026-49476",
  "lastModified": "2026-07-15T20:22:12.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49476",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T14:26:25.402577Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T21:17:01.877",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "soupsieve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T13:37:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x\u2014 amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector \u00e2\u20ac\u201d this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python\u0027s `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488\u00c3\u2014 |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target\u0027s memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/",
  "id": "GHSA-2wc2-fm75-p42x",
  "modified": "2026-07-09T13:37:40Z",
  "published": "2026-07-09T13:37:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/soupsieve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-soupsieve",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-soupsieve fixes the following issues\n\n- CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists (bsc#1271187).\n- CVE-2026-49477: Regular Expression Denial of Service (ReDoS) via Selector Parser (bsc#1271188).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1246",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21342-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271187",
        "url": "https://bugzilla.suse.com/1271187"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271188",
        "url": "https://bugzilla.suse.com/1271188"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-49476 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-49476/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-49477 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-49477/"
      }
    ],
    "title": "Security update for python-soupsieve",
    "tracking": {
      "current_release_date": "2026-07-14T10:43:25Z",
      "generator": {
        "date": "2026-07-14T10:43:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21342-1",
      "initial_release_date": "2026-07-14T10:43:25Z",
      "revision_history": [
        {
          "date": "2026-07-14T10:43:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-soupsieve-2.6-160000.4.1.noarch",
                "product": {
                  "name": "python313-soupsieve-2.6-160000.4.1.noarch",
                  "product_id": "python313-soupsieve-2.6-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-soupsieve-2.6-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        },
        "product_reference": "python313-soupsieve-2.6-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49476",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-49476"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-49476",
          "url": "https://www.suse.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271187 for CVE-2026-49476",
          "url": "https://bugzilla.suse.com/1271187"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-14T10:43:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-49476"
    },
    {
      "cve": "CVE-2026-49477",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-49477"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-49477",
          "url": "https://www.suse.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271188 for CVE-2026-49477",
          "url": "https://bugzilla.suse.com/1271188"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-soupsieve-2.6-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-14T10:43:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-49477"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "soupsieve",
        "purl": "pkg:pypi/soupsieve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4",
        "0.5",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.6",
        "1.0",
        "1.0.1",
        "1.0.2",
        "1.0b1",
        "1.0b2",
        "1.1",
        "1.2",
        "1.2.1",
        "1.3",
        "1.3.1",
        "1.4",
        "1.5",
        "1.6",
        "1.6.1",
        "1.6.2",
        "1.7",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8",
        "1.9",
        "1.9.1",
        "1.9.2",
        "1.9.3",
        "1.9.4",
        "1.9.5",
        "1.9.6",
        "2.0",
        "2.0.1",
        "2.1",
        "2.2",
        "2.2.1",
        "2.3",
        "2.3.1",
        "2.3.2",
        "2.3.2.post1",
        "2.4",
        "2.4.1",
        "2.5",
        "2.6",
        "2.7",
        "2.8",
        "2.8.1",
        "2.8.2",
        "2.8.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49476",
    "GHSA-2wc2-fm75-p42x"
  ],
  "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x\u2014 amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup\u0027s `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector \u00e2\u20ac\u201d this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python\u0027s `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488\u00c3\u2014 |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target\u0027s memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/",
  "id": "PYSEC-2026-3071",
  "modified": "2026-07-13T16:06:19.956276Z",
  "published": "2026-07-13T15:46:30.039329Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facelessuser/soupsieve"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/soupsieve"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2wc2-fm75-p42x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython-attrs:\n  * python3-attrs-26.1.0-3.hum1 (noarch)\n  * python-attrs-26.1.0-3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:23992",
        "url": "https://access.redhat.com/errata/RHSA-2026:23992"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49476",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23992.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-15T15:31:33+00:00",
      "generator": {
        "date": "2026-07-15T15:31:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.6"
        }
      },
      "id": "RHSA-2026:23992",
      "initial_release_date": "2026-06-07T00:53:38+00:00",
      "revision_history": [
        {
          "date": "2026-06-07T00:53:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-15T10:50:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-15T15:31:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-attrs-main@src",
                "product": {
                  "name": "python-attrs-main@src",
                  "product_id": "python-attrs-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-attrs@26.1.0-3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-attrs-main@noarch",
                "product": {
                  "name": "python-attrs-main@noarch",
                  "product_id": "python-attrs-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-attrs@26.1.0-3.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-attrs-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-attrs-main@noarch"
        },
        "product_reference": "python-attrs-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-attrs-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-attrs-main@src"
        },
        "product_reference": "python-attrs-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49476",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T22:01:41.402642+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. Red Hat ships soupsieve as a dependency in multiple products including OpenShift, Ceph Storage, RHOAI, Satellite, Ansible Automation Platform, OpenStack Platform, CNV, Lightspeed, and various container images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-attrs-main@noarch",
          "Red Hat Hardened Images:python-attrs-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39",
          "url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
        }
      ],
      "release_date": "2026-07-14T20:53:12.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-07T00:53:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23992"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk.",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-attrs-main@noarch",
          "Red Hat Hardened Images:python-attrs-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-07T00:53:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23992"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-attrs-main@noarch",
            "Red Hat Hardened Images:python-attrs-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython-rpds-py:\n  * python3-rpds-py-2026.6.3-1.hum1 (aarch64, x86_64)\n  * python-rpds-py-2026.6.3-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:34119",
        "url": "https://access.redhat.com/errata/RHSA-2026:34119"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45409",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49476",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34119.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-15T15:31:33+00:00",
      "generator": {
        "date": "2026-07-15T15:31:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.6"
        }
      },
      "id": "RHSA-2026:34119",
      "initial_release_date": "2026-07-01T09:00:32+00:00",
      "revision_history": [
        {
          "date": "2026-07-01T09:00:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-15T10:50:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-15T15:31:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@src",
                "product": {
                  "name": "python-rpds-py-main@src",
                  "product_id": "python-rpds-py-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-rpds-py@2026.6.3-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@aarch64",
                "product": {
                  "name": "python-rpds-py-main@aarch64",
                  "product_id": "python-rpds-py-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-rpds-py@2026.6.3-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rpds-py-main@x86_64",
                "product": {
                  "name": "python-rpds-py-main@x86_64",
                  "product_id": "python-rpds-py-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-rpds-py@2026.6.3-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@aarch64"
        },
        "product_reference": "python-rpds-py-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@src"
        },
        "product_reference": "python-rpds-py-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rpds-py-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        },
        "product_reference": "python-rpds-py-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-45409",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-05T23:01:44.292958+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library\u0027s encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the python-idna library. This is an incomplete fix for CVE-2024-3651. The idna.encode() function performs contextual validation checks (valid_contexto) before rejecting oversized inputs, allowing specially crafted long payloads to cause excessive CPU consumption and lead to a denial of service. The fix in version 3.14 rejects long inputs early before further processing, and version 3.15 extends this approach to alternate per-label conversion and codec functions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx",
          "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"
        }
      ],
      "release_date": "2026-06-05T22:06:07.082000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        },
        {
          "category": "workaround",
          "details": "To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability.\n\nApplications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length \u003c 254 chars) are affected.",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-idna: idna: Denial of Service via specially crafted long inputs"
    },
    {
      "cve": "CVE-2026-49476",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T22:01:41.402642+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. Red Hat ships soupsieve as a dependency in multiple products including OpenShift, Ceph Storage, RHOAI, Satellite, Ansible Automation Platform, OpenStack Platform, CNV, Lightspeed, and various container images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39",
          "url": "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"
        }
      ],
      "release_date": "2026-07-14T20:53:12.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk.",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python-rpds-py-main@aarch64",
          "Red Hat Hardened Images:python-rpds-py-main@src",
          "Red Hat Hardened Images:python-rpds-py-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-01T09:00:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34119"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python-rpds-py-main@aarch64",
            "Red Hat Hardened Images:python-rpds-py-main@src",
            "Red Hat Hardened Images:python-rpds-py-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    }
  ]
}