Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector processing. Matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, allowing attackers controlling input HTML or XML to cause significant CPU consumption. This affects applications that run CSS selectors on untrusted markup. The issue is fixed in Soup Sieve 4.0 by caching intermediate results to ensure linear-time matching.