THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-gjv8-xp57-g29c (medium) — Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

[GHSA] GHSA-gjv8-xp57-g29c (medium) — Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

medgithub_advisoriesPublished 2026-09-17

GHSA-gjv8-xp57-g29c Severity: medium CVE: CVE-2026-86000

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

## Summary

soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFIER` sub-pattern (also embedded in `VALUE`, and therefore in attribute selectors) places two adjacent quantified groups over ove

Indicators of compromise

CVE-2026-86000cve

Original source: https://github.com/advisories/GHSA-gjv8-xp57-g29c