CVE-2026-85999 facelessuser CVE debrief

Who should care

Defenders responsible for applications using Soup Sieve for CSS selection, especially those exposed to user-controlled input, should assess and remediate this vulnerability. This includes operators, platform administrators, vulnerability managers, and security teams who need to verify affected versions and exposure.

Why it matters

Defenders should prioritize assessment and remediation of this vulnerability in applications using Soup Sieve for CSS selection, especially those exposed to user-controlled input, to prevent potential service stall.

• Service stall due to excessive CPU consumption.
• Potential for denial of service (DoS) attacks.
• Need for verification of affected versions and exposure.
• Remediation priority for applications using vulnerable Soup Sieve versions.

Technical summary

The vulnerability in Soup Sieve causes quadratic CPU work when processing attacker-controlled selectors, potentially leading to service stall. This issue arises from the selector_iter function in src/soupsieve/css_parser.py, which trims the raw selector using RE_WS_END. An attacker-controlled valid selector containing a long internal whitespace run or a selector containing a long CSS comment run followed by another token can cause this issue. The issue is fixed in version 2.9. No memory corruption or code execution occurs.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability in applications using Soup Sieve for CSS selection, especially those exposed to user-controlled input.

Recommended defensive actions

• Assess exposure in applications using Soup Sieve for CSS selection, especially those with user-controlled input.
• Verify if applications are using Soup Sieve version 2.9 or later.
• Implement compensating controls, such as input validation and monitoring, if upgrade is not feasible.
• Review and update incident response plans to address potential service stall.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is described in the CVE record and NVD detail page. The issue is fixed in Soup Sieve version 2.9. Evidence is limited to public CVE and NVD records. Defenders should verify affected versions and exposure with limited source information. No additional evidence is available for review. The CVE record was published on 2026-09-17T16:18:16.590Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.