Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with document nesting depth, causing excessive CPU usage on deeply nested untrusted documents. This can lead to denial of service by tying up processing resources for seconds to minutes. The issue is fixed in Soup Sieve 4.0 by caching intermediate results to ensure linear time complexity.