CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators causes polynomial-time complexity relative to document nesting depth, allowing attackers controlling input HTML/XML to cause high CPU usage. The issue is fixed in Soup Sieve version 4.6.6 by caching intermediate results to reduce complexity to linear time. Applications processing untrusted markup with descendant combinators in selectors are affected. Upgrading to 4.6.6 or later mitigates the issue.