AIKIDO-2026-11057

TL;DR

Affected versions of this package are vulnerable to memory exhaustion via large comma-separated selector lists. The CSS selector parser creates one CSSSelector object per comma-delimited segment without enforcing a limit on the number of segments, so a relatively small crafted selector string passed to soupsieve.compile() or Beautiful Soup's .select() / .select_one() allocates hundreds of megabytes of heap memory (about a 488x amplification from input size). An attacker who can supply or influence the selector input can trigger memory exhaustion and denial of service. The fix caps the total number of selectors processed per pattern.