CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors using descendant combinators. The matching time grows polynomially with document nesting depth, causing excessive CPU usage on deeply nested untrusted documents. This affects applications that run selectors with descendant combinators on untrusted HTML or XML input. The issue is fixed in Soup Sieve 4.0 by introducing caching to reduce matching complexity to linear time.