Описание
Security update for python-soupsieve
This update for python-soupsieve fixes the following issues
- CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists (bsc#1271187).
- CVE-2026-49477: Regular Expression Denial of Service (ReDoS) via Selector Parser (bsc#1271188).
Список пакетов
SUSE Linux Enterprise Module for Python 3 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3240-1
- E-Mail link for SUSE-SU-2026:3240-1
- SUSE Security Ratings
- SUSE Bug 1256316
- SUSE Bug 1271187
- SUSE Bug 1271188
- SUSE CVE CVE-2026-49476 page
- SUSE CVE CVE-2026-49477 page
Описание
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.
Затронутые продукты
Ссылки
- CVE-2026-49476
- SUSE Bug 1271187
Описание
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.
Затронутые продукты
Ссылки
- CVE-2026-49477
- SUSE Bug 1271188