add: AVE-2018-0028

Author: adysec

vulns/2026/AVE-2026-0055.toml

@@ -0,0 +1,35 @@
+[id]
+ave_id = "AVE-2026-0055"
+cve_id = "CVE-2026-49477"
+aliases = ["GHSA-836r-79rf-4m37"]
+
+[basic]
+title = "soupsieve CSS选择器解析器正则表达式拒绝服务(ReDoS)漏洞"
+description = "soupsieve是Beautiful Soup 4使用的CSS选择器引擎，其css_parser.py中VALUE正则表达式存在灾难性回溯漏洞。当处理未闭合引号的属性选择器（如[a=\"xxx...）时，正则引擎进入指数级回溯，仅需300字节载荷即可导致CPU耗尽超过3秒，造成拒绝服务(ReDoS)。攻击者无需认证即可远程利用，影响所有接受用户CSS选择器输入的Python应用。"
+severity = "HIGH"
+score = 7.5
+cvss_v3 = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+remediation = "升级soupsieve至2.8.4及以上版本，该版本已修复正则表达式回溯问题。如无法升级，应避免将用户输入的CSS选择器直接传递给soupsieve.compile()或BeautifulSoup的.select()/.select_one()方法，并对用户输入进行严格的格式校验。"
+published = "2026-06-01"
+updated = "2026-07-09"
+sources = ["ghsa"]
+
+[affected]
+vendor = "facelessuser"
+product = "soupsieve"
+
+[references]
+urls = [
+  "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
+  "https://github.com/facelessuser/soupsieve",
+  "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
+]
+
+[exploit]
+poc_urls = ["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"]
+exp_urls = []
+nuclei_templates = []
+
+[meta]
+status = "completed"
+collected_at = "2026-07-11T10:00:00+08:00"