CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators causes polynomial-time complexity relative to document nesting depth, allowing an attacker controlling input HTML or XML to cause excessive CPU usage. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce matching time to linear complexity. Applications processing untrusted deeply nested documents with descendant combinators in selectors are vulnerable if not upgraded.