Soup Sieve versions prior to 4.0.0 contain a polynomial-time denial of service vulnerability in the descendant combinator selector matching. The time complexity grows polynomially with the nesting depth of the document and the number of descendant combinators in the selector, allowing an attacker controlling input HTML or XML to cause high CPU usage by submitting deeply nested documents. This can lead to significant delays or denial of service in applications using Soup Sieve to process untrusted markup. The issue is fixed in version 4.0.0 by introducing caching to reduce matching time to linear complexity.