CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm has polynomial time complexity relative to document nesting depth, causing excessive CPU usage on deeply nested documents with selectors containing multiple descendant combinators. This can be exploited by attackers controlling input HTML or XML to cause high CPU load and service disruption. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce matching time to linear complexity.