CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators causes polynomial-time complexity relative to document nesting depth, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. The issue is fixed in Soup Sieve version 3.24.1_1 by caching intermediate matching results to reduce complexity to linear time. Applications processing untrusted markup with descendant combinators in selectors are affected. Upgrading to the fixed version mitigates the issue.