CVE-2026-126190 is a denial-of-service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm exhibits polynomial-time complexity relative to document nesting depth, causing excessive CPU usage on deeply nested documents with untrusted input. This can tie up application workers for extended periods. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce matching complexity to linear time.