CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators against deeply nested documents causes polynomial-time complexity, leading to high CPU usage. This affects applications that process untrusted HTML or XML documents using Soup Sieve or Beautiful Soup's selector methods. The issue is fixed in Soup Sieve version 4.0 by caching intermediate results to reduce complexity to linear time. Applications using affected versions and processing untrusted input should upgrade to mitigate the risk.