Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with the nesting depth of the document, allowing an attacker controlling the input HTML or XML to cause excessive CPU usage by submitting deeply nested documents. This can tie up processing for seconds to minutes on typical selectors like 'section div div'. The issue is fixed in Soup Sieve 4.0 by caching intermediate results to reduce complexity to linear time.