Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. Matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, allowing attackers controlling input HTML or XML to cause significant processing delays. The issue is fixed in version 4.0 by caching intermediate results to reduce complexity to linear time. Applications that run selectors with descendant combinators on untrusted documents are vulnerable if not upgraded.