CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm exhibits polynomial-time complexity relative to document nesting depth and the number of descendant combinators, causing excessive CPU usage on crafted deeply nested documents. This can tie up application workers for extended periods when processing untrusted HTML or XML. The issue is fixed in Soup Sieve 4.0 by introducing caching to reduce matching complexity to linear time.