Description
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive.

The impact is CPU exhaustion only. Nothing is read, modified or disclosed.

This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Published: 2026-08-06
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inefficient regular expression in the CSS scrubber of the html_sanitize_ex library allows an attacker to trigger quadratic backtracking by sending a long run of characters that match the property name pattern before the colon is found. The resulting CPU usage can exceed 2 seconds for an 80 KB style block, and multiple concurrent requests can saturate the BEAM scheduler, rendering the application unresponsive. The vulnerability does not grant any information disclosure, modification, or authentication bypass; its sole effect is to consume system resources.

Affected Systems

The vulnerability affects the rrrene html_sanitize_ex library in all releases from 0.3.1 up to but not including version 1.5.3. Anyone deploying these versions within a web application that sanitizes user supplied HTML is vulnerable.

Risk and Exploitability

With a CVSS score of 8.2 the risk is high. EPSS data is not available, and the issue is not listed in CISA's KEV catalog, however the lack of authorization checks and the ability to craft arbitrary HTTP requests mean an unauthenticated remote attacker can trivially exercise the denial-of-service effect. The attack path involves sending a crafted style block to the sanitizer; no additional system access is required.

Generated by OpenCVE AI on August 6, 2026 at 16:58 UTC.

Remediation

Vendor Workaround

Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which reach the CSS scrubber, or define a custom scrubber that allows neither <style> elements nor style attributes. Capping the size of user-supplied HTML before it reaches the sanitizer bounds the cost, though the quadratic growth means the cap has to be small to be effective.

OpenCVE Recommended Actions

  • Upgrade to html_sanitize_ex release 1.5.3 or newer, which eliminates the quadratic regex
  • Apply the workaround by sanitizing with basic_html/1, markdown_html/1 or strip_tags/1, which bypasses the CSS scrubber
  • Limit the size of user-supplied HTML before it reaches the sanitizer to reduce CPU usage, or define a custom scrubber that disallows <style> elements and style attributes

Generated by OpenCVE AI on August 6, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Title Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
First Time appeared Rrrene
Rrrene html Sanitize Ex
Weaknesses CWE-1333
CPEs cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
Vendors & Products Rrrene
Rrrene html Sanitize Ex
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rrrene Html Sanitize Ex
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-06T14:50:12.593Z

Reserved: 2026-07-31T13:23:00.355Z

Link: CVE-2026-68749

cve-icon Vulnrichment

Updated: 2026-08-06T15:44:18.372Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T17:00:11Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity