Soup Sieve versions >=0.11.9 and <0.23.1_3 are vulnerable to a polynomial-time denial of service (DoS) caused by the descendant combinator in CSS selectors. The vulnerability arises because matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, leading to significant processing delays. This can be exploited by an attacker controlling the HTML or XML input to cause high CPU usage and denial of service. The issue is fixed in version 0.23.1_3 by introducing caching to reduce matching time to linear complexity.