Read the docs
TI-2026-48335 Aliases CVE-2026-68750GHSA-684p-mhw3-3cwq

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Priority LOW 37CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00802 56th percentileScored 2026-11-07
Fix Fixed html_sanitize_ex (rrrene): 1.4.5, 1.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rrrenehtml_sanitize_ex0.3.1 to before 1.4.5; 1.5.0-rc.0 to before 1.5.31.4.5, 1.5.3Patch availableCNA
  • html_sanitize_ex Vendorrrrene Affected 0.3.1 to before 1.4.5; 1.5.0-rc.0 to before 1.5.3 Fixed in 1.4.5, 1.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*0.3.1 to before 1.5.3Vulnerablerrrene
  • cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:* Versions 0.3.1 to before 1.5.3 Vulnerable ·rrrene

Remediation

  • Fix · CNA html_sanitize_ex (rrrene) Fixed in 1.4.5, 1.5.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rrrene html_sanitize_ex 1.4.5, 1.5.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-48334 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of servicePriority LOW 37
    • TI-2026-47137 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijackingPriority LOW 22
    • TI-2026-47464 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embeddingPriority LOW 13
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68750
  2. 2026-10-03 Alias added: GHSA-684p-mhw3-3cwq

References

Patch 4

Advisory 1

  • TI-2026-48334 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service CVSS 4.0HIGH 8.2
  • TI-2026-47137 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking CVSS 4.0MEDIUM 4.8
  • TI-2026-47464 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding CVSS 4.0LOW 2.3
  • TI-2026-47457 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection CVSS 4.0LOW 2.3
  • TI-2026-48333 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences