CVE-2026-68750

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2

Description An inefficient algorithmic complexity issue exists in the traversal engine. An unauthenticated remote attacker can exhaust server CPU and memory by providing a flat run of sibling elements in sanitized HTML. The HtmlSanitizeEx.Traverser.traverse/2 function recurses on the tail of a sibling list and evaluates List.flatten([head] ++ tail) over the already flattened result. This causes every sibling to copy and re-walk the entire remaining tail, resulting in quadratic traversal cost relative to the sibling count. This issue affects all public entry points and requires only allowed tags in the payload. For example, a 160 KB body containing 20,000 sibling elements can occupy a scheduler for approximately 1.7 seconds.

Recommendations Update html sanitize ex to version 1.5.3 or later. Cap the size of user-supplied HTML, specifically the node count, before it reaches the sanitizer.