Read the docs
TI-2026-48334 Aliases CVE-2026-68749GHSA-8rjf-8hw9-j63g

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Priority LOW 37CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00802 56th percentileScored 2026-11-07
Fix Fixed html_sanitize_ex (rrrene): 1.4.5, 1.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rrrenehtml_sanitize_ex0.3.1 to before 1.4.5; 1.5.0-rc.0 to before 1.5.31.4.5, 1.5.3Patch availableCNA
  • html_sanitize_ex Vendorrrrene Affected 0.3.1 to before 1.4.5; 1.5.0-rc.0 to before 1.5.3 Fixed in 1.4.5, 1.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*0.3.1 to before 1.5.3Vulnerablerrrene
  • cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:* Versions 0.3.1 to before 1.5.3 Vulnerable ·rrrene

Remediation

  • Fix · CNA html_sanitize_ex (rrrene) Fixed in 1.4.5, 1.5.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rrrene html_sanitize_ex 1.4.5, 1.5.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-48335 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of servicePriority LOW 37
    • TI-2026-47137 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijackingPriority LOW 22
    • TI-2026-47464 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embeddingPriority LOW 13
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68749
  2. 2026-10-03 Alias added: GHSA-8rjf-8hw9-j63g

References

Patch 4

Advisory 1

  • TI-2026-48335 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service CVSS 4.0HIGH 8.2
  • TI-2026-47137 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking CVSS 4.0MEDIUM 4.8
  • TI-2026-47464 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding CVSS 4.0LOW 2.3
  • TI-2026-47457 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection CVSS 4.0LOW 2.3
  • TI-2026-48333 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences