CVE-2026-126190 is a polynomial-time denial of service vulnerability in Soup Sieve's handling of CSS descendant combinators. Matching selectors with descendant combinators against deeply nested documents causes CPU time to grow polynomially with nesting depth, allowing attackers controlling input HTML/XML to cause significant processing delays. The issue is fixed in Soup Sieve 4.0 by caching intermediate results to reduce complexity to linear time. Applications processing untrusted markup with descendant combinators in selectors are affected, while those using only trusted documents are not.