Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. Matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, allowing attackers controlling input HTML or XML to cause significant processing delays. This affects applications using Soup Sieve or Beautiful Soup's select methods on untrusted markup. The issue is fixed in version 4.0 by caching intermediate results to reduce complexity to linear time.