Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with document nesting depth, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This affects applications that run descendant combinator selectors on untrusted markup. The issue is fixed in Soup Sieve 4.0 by caching ancestor matches, reducing complexity to linear time.