The vulnerability is caused by an inefficient algorithmic loop in the html_sanitize_ex Traverser that performs a flatten operation on every sibling element during traversal. This results in quadratic time and space complexity, allowing an attacker to supply a flat list of sibling nodes that triggers excessive CPU and memory consumption. The impact is a server‑level denial of service, as the sanitizer runs until the process is killed or resources are exhausted. The weakness is identified as CWE‑407: Excessive Calculation.

The flaw exists in the rrrene html_sanitize_ex library versions up to and including 1.5.2. Any system that incorporates these versions and invokes the sanitizer via a public entry point is affected; a user can trigger the issue regardless of authentication status or special configuration, simply by sending a payload that contains many sibling elements and allowed tags.

The CVSS score of 8.2 classifies this issue as high severity. The EPSS score is not available, so the exact exploitation probability cannot be estimated, but the flaw can be exploited from the network without authentication and only requires sending a crafted HTML body. Because the HTML sanitizer is part of every public input endpoint, deployment of the vulnerable library effectively exposes the entire application to CPU‐exhaustion attacks. The vulnerability is not currently listed in the CISA KEV catalog, but its impact warrants prompt remediation.