Soup Sieve versions starting from 2.0.1 are vulnerable to a polynomial-time denial of service (DoS) when processing CSS selectors with descendant combinators on deeply nested HTML or XML documents. The time complexity grows polynomially with the nesting depth and the number of descendant combinators, causing excessive CPU usage. This can be exploited by attackers controlling the input documents to cause significant processing delays. The vulnerability is fixed in version 4.0 by introducing caching to reduce the complexity to linear time.