Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. This occurs because matching selectors with descendant combinators takes time that grows polynomially with document nesting depth, allowing an attacker controlling input HTML or XML to cause high CPU usage with small, deeply nested documents. The issue is fixed in version 4.0 by introducing caching to reduce matching time to linear complexity.