Soup Sieve versions from 2.1.0 onward have a polynomial-time denial of service vulnerability in the descendant combinator selector matching. This flaw causes selector matching time to grow polynomially with document nesting depth, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. The issue is fixed in version 4.0 by caching intermediate results, reducing complexity to linear time. Applications running descendant combinator selectors on untrusted input are affected; those processing only trusted documents are not.