CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators causes polynomial-time complexity relative to document nesting depth, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This affects applications that run such selectors on untrusted markup. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce matching complexity to linear time.