Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time complexity grows polynomially with the nesting depth of the document and the number of descendant combinators in the selector, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This affects applications using Soup Sieve or Beautiful Soup's select functions on untrusted markup. The issue is fixed in version 4.0 by introducing caching to reduce matching time to linear complexity.