CVE-2026-126190 is a polynomial-time denial of service vulnerability in Soup Sieve's handling of CSS descendant combinators. Matching selectors with descendant combinators causes processing time to grow polynomially with document nesting depth, allowing attackers controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. The issue affects versions prior to 3.4.4 and was fixed in 3.4.4 by adding caching to reduce matching complexity to linear time. Applications that run selectors with descendant combinators on untrusted documents are vulnerable. Upgrading to 3.4.4 or later mitigates the issue.