Soup Sieve versions prior to 4.0 suffer from a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with the nesting depth of the document, causing excessive CPU usage on deeply nested untrusted HTML or XML input. This can lead to significant processing delays or denial of service in applications using Soup Sieve or Beautiful Soup's select methods on untrusted markup. The issue is fixed in version 4.0 by introducing caching to reduce matching time to linear complexity.