facelessuser soupsieve
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-85999 | < 2.9 | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-86000 | < 2.9 | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-49476 | < 2.8.4 | Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve | HIGH 7.5 | 0.6 % | ||
| CVE-2026-49477 | < 2.8.4 | Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser | HIGH 7.5 | 0.6 % |