CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm has polynomial time complexity relative to the document's nesting depth and the number of descendant combinators, allowing an attacker controlling input HTML or XML to cause excessive CPU usage by submitting deeply nested documents. This affects applications that run selectors on untrusted markup. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce complexity to linear time.