CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm exhibits polynomial-time complexity relative to the document's nesting depth and the number of descendant combinators, allowing an attacker controlling input HTML or XML to cause high CPU usage by crafting deeply nested documents. This can tie up application workers for extended periods. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce matching time to linear complexity. Applications processing untrusted markup with descendant combinators in selectors are affected; those processing only trusted documents are not.