CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm exhibits polynomial time complexity relative to document nesting depth, causing excessive CPU usage on deeply nested documents. This affects applications that run such selectors on untrusted HTML or XML input. The issue is fixed in Soup Sieve version 3.22.11 and later.