Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time complexity grows polynomially with the nesting depth of the document and the number of descendant combinators in the selector, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This can tie up application workers for seconds to minutes. The issue is fixed in Soup Sieve 4.0 by caching ancestor matching results, reducing complexity to linear time.