Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with the nesting depth of the document, causing excessive CPU usage on deeply nested untrusted HTML or XML input. This can lead to denial of service by tying up processing resources for seconds to minutes. The issue is fixed in version 4.0 by introducing caching to reduce the complexity to linear time.