CVE-2026-68749

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2

Description An unauthenticated remote attacker can cause server CPU exhaustion by providing a long CSS declaration within sanitized HTML. The issue resides in the HtmlSanitizeEx.Scrubber.CSS.scrub/1 function, where a regular expression used to match property names employs an unbounded greedy [-w]+ followed by a mandatory colon. When a long sequence of word characters is not followed by a colon, the engine performs quadratic work relative to the length of the run. This can saturate the BEAM scheduler pool, rendering the application unresponsive. This issue specifically affects HtmlSanitizeEx.html5/1, custom scrubbers using HtmlSanitizeEx, extend: :html5, and direct calls to HtmlSanitizeEx.Scrubber.CSS.scrub/1 via style attributes or <style> element bodies.

Recommendations Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize input using basic html/1, markdown html/1, or strip tags/1 to avoid the CSS scrubber. Define a custom scrubber that prohibits both style attributes and <style> elements. Implement a strict size limit on user-supplied HTML before it reaches the sanitizer to bound the processing cost.