Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with the nesting depth of the document, causing excessive CPU usage on deeply nested inputs. This affects applications that run CSS selectors with descendant combinators on untrusted HTML or XML documents. The issue is fixed in Soup Sieve 4.0 by caching intermediate results to reduce complexity to linear time.