CVE-2026-68750 Details
Description
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
A vulnerability has been identified in the traversal engine of the rrrene html_sanitize_ex library, specifically in versions 0.3.1 prior to 1.5.3. This vulnerability allows an unauthenticated remote attacker to cause excessive CPU and memory usage on the server. The issue arises from the way the traversal engine handles sibling elements in sanitized HTML. The traversal process recursively processes the tail of a sibling list while repeatedly flattening the list, resulting in a quadratic increase in processing time relative to the number of sibling elements. This inefficient handling can be exploited by sending a payload with a large number of sibling elements, causing significant performance degradation. The vulnerability is present in all public entry points of the library, requiring no special configuration or scrubber.
Users can upgrade to html_sanitize_ex version 1.5.3 or later, where this vulnerability has been fixed. Additionally, it is recommended to cap the size of user-supplied HTML, particularly the node count, before it reaches the sanitizer, as the quadratic growth in processing time requires a small cap to be effective.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-68750.html | EEF | PatchThird Party Advisory |
| https://github.com/rrrene/html_sanitize_ex/commit/507a6fb95dd4c466cac8a8355d8989043e9fbcc1 | EEF | |
| https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e | EEF | Patch |
| https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-463q-p2fr-mh9p | EEF | Broken Link |
| https://osv.dev/vulnerability/EEF-CVE-2026-68750 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | EEF |
Affected Products
| Product | Versions |
|---|---|
| rrrene htmlsanitizeex | >= 0.3.1, < 1.5.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 19, 2026 | CVE Modified | EEF |
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | EEF |