Soup Sieve versions prior to 4.0 have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time to match selectors with descendant combinators grows polynomially with the nesting depth of the document, allowing an attacker controlling the HTML or XML input to cause high CPU usage by submitting deeply nested documents. This can cause significant delays or denial of service in applications that use Soup Sieve to run CSS selectors on untrusted markup. The issue is fixed in version 4.0 by caching intermediate results to reduce matching time to linear complexity.