An inefficient regular expression in the CSS scrubber of rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust the server’s CPU by sending a long CSS declaration within sanitized HTML. The regex matches a property name with an unbounded greedy [-\w]+ followed by a mandatory colon. When a long run of word characters not followed by a colon is encountered, the regex engine backtracks one character at a time and retries the colon at every offset, resulting in quadratic time complexity. With no length cap on the HTML passed to the scrubber, an 80‑KB <style> block can consume roughly 2.4 seconds of scheduler time; multiple concurrent requests can saturate the BEAM scheduler pool and render the application unresponsive. The vulnerability does not read, modify, or disclose any data; its sole impact is CPU exhaustion.

The vulnerability affects the rrrene html_sanitize_ex library in all releases from 0.3.1 up to but not including version 1.5.3. Anyone deploying these versions within a web application that sanitizes user supplied HTML is vulnerable.

With a CVSS score of 8.2 the risk is high. The EPSS score of 0.00441 (0.441%) indicates a very low but non‑zero likelihood of exploitation, and the issue is not listed in CISA's KEV catalog, however the lack of authorization checks and the ability to craft arbitrary HTTP requests mean an unauthenticated remote attacker can trivially exercise the denial‑of‑service effect. The attack path involves sending a crafted style block to the sanitizer; no additional system access is required.