CVE-2026-126190 is a denial-of-service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. Matching selectors with multiple descendant combinators causes polynomial-time complexity relative to document nesting depth, allowing attackers controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. The issue is fixed in Soup Sieve version 4.0 by caching intermediate results to reduce matching time to linear complexity. Applications processing untrusted markup with descendant combinators in selectors are affected. Upgrading to version 4.0 or later mitigates the issue.