CVE-2026-68749 Details

A denial-of-service vulnerability has been identified in the CSS scrubber of the rrrene html_sanitize_ex library, versions 0.3.1 prior to 1.5.3. This vulnerability arises from inefficient regular expression processing that allows an unauthenticated remote attacker to exhaust server CPU resources. The issue is triggered by a long CSS declaration in sanitized HTML, which the scrubber processes using a regex that matches property names with an unbounded greedy pattern. This leads to quadratic backtracking, where the regex engine takes an excessive amount of time to process the input. As a result, an 80 KB <style> body can consume approximately 2.4 seconds of scheduler time, causing the application to become unresponsive under concurrent load.

Users can update to html_sanitize_ex version 1.5.4 or later, or sanitize with basic_html/1, markdown_html/1, or strip_tags/1, none of which reach the CSS scrubber. Alternatively, define a custom scrubber that disallows <style> elements and style attributes.