Soup Sieve versions before 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. This occurs because matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, potentially tying up processing for seconds to minutes. The issue is fixed in version 4.0 by caching intermediate matching results to reduce complexity to linear time.