The html_sanitize_ex traversal engine suffers from an inefficient algorithm that executes in quadratic time with respect to the number of sibling elements in a flat list. The traverser’s implementation recurses on the tail of the sibling list and then applies List.flatten([head] ++ tail) to the accumulated result, causing each of the n siblings to copy and traverse the remaining tail. Because this cost is paid for every node, the overall traversal becomes O(n²). An attacker can exploit this by sending a crafted HTML payload containing many allowed tags as sibling elements; the payload does not require any special configuration or authentication, as the sanitizer is invoked on every public entry point. A 160‑KB body with 20,000 sibling elements can saturate the scheduler for roughly 1.7 seconds, and the cost grows faster than the body size. This issue is designated CWE‑407.

The flaw exists in the rrrene html_sanitize_ex library versions up to and including 1.5.2. Any system that incorporates these versions and invokes the sanitizer via a public entry point is affected; a user can trigger the issue regardless of authentication status or special configuration, simply by sending a payload that contains many sibling elements and allowed tags.

The CVSS score of 8.2 classifies this issue as high severity. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation. This vulnerability is exploitable from the network without authentication and simply requires sending a crafted HTML body that contains many sibling elements and allowed tags. Because the HTML sanitizer is part of every public input endpoint, an application that includes a vulnerable version of html_sanitize_ex effectively exposes the entire system to CPU‑exhaustion attacks. The vulnerability is not listed in the CISA KEV catalog, but its impact warrants prompt remediation.