Vulnerabilities for soupsieve

First version without a known vulnerability: 2.9

Details

• GHSA-gjv8-xp57-g29c2026-09-17

  Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

  Fixed in: 2.9.0

• GHSA-j934-xhv5-fg8f2026-09-17

  Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

  Fixed in: 2.9.0

• GHSA-836r-79rf-4m372026-07-09

  Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

  Fixed in: 2.8.4

• GHSA-2wc2-fm75-p42x2026-07-09

  Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

  Fixed in: 2.8.4