High [CVE-2026-49477] Denial of Service via crafted CSS selector strings

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.

Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup.select() /.select_one() to cause CPU exhaustion and denial of service.

This issue is fixed in version 2.8.4. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333.

Affected Red Hat products: Red Hat Hardened Images; Red Hat OpenShift AI 3.4; Red Hat Quay 3.10; Red Hat Quay 3.12; Red Hat Quay 3.14; Red Hat Quay 3.15; Red Hat Quay 3.16; Red Hat Quay 3.17; Red Hat Quay 3.18; Red Hat Quay 3.9; Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Virtualization 4.

Will not fix / out of support: Red Hat Ansible Automation Platform 2.