CVE-2026-126190 is a denial-of-service vulnerability in Soup Sieve's handling of CSS descendant combinators. Matching selectors with descendant combinators against deeply nested documents causes polynomial-time complexity, leading to high CPU usage and potential service disruption. The issue affects applications that process untrusted HTML or XML documents using Soup Sieve versions prior to 4.0. The vulnerability is fixed in Soup Sieve 4.0 by introducing caching to reduce matching time to linear complexity.