Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The matching time grows polynomially with the nesting depth of the document and the number of descendant combinators in the selector, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This can cause significant delays or denial of service in applications that use Soup Sieve to run CSS selectors on untrusted markup. The issue is fixed in version 4.0 by introducing caching to reduce the complexity to linear time.