CVE-2026-68749

Analyzed Analyzed - Analysis Complete

Inefficient Regular Expression Complexity in html_sanitize_ex CSS Scrubber

Publication date: 2026-08-06

Last updated on: 2026-08-11

Assigner: EEF

Description

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-11

Generated

2026-08-18

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-17

NVD

CVE-2026-68749

EUVD

EUVD-2026-54084

Affected Vendors & Products

Vendor	Product	Version / Range
rrrene	htmlsanitizeex	From 0.3.1 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This is a Regular Expression Complexity vulnerability in the CSS scrubber of the html_sanitize_ex library. An attacker can send a long CSS declaration without a colon in property names, causing the regex engine to perform excessive backtracking. This leads to quadratic CPU time usage, potentially making the application unresponsive.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage on systems using html_sanitize_ex versions 0.3.1 to 1.5.2. Check for slow responses or unresponsiveness in applications processing HTML with CSS content. Use system monitoring tools like top, htop, or ps to observe CPU load spikes during HTML sanitization tasks.

Impact Analysis

The main impact is CPU exhaustion, which can saturate server resources with just a few concurrent requests. This may cause the application to become unresponsive or slow down significantly. No data is read, modified, or disclosed.

Compliance Impact

This vulnerability primarily causes CPU exhaustion through regex backtracking in CSS sanitization, leading to denial-of-service conditions. It does not involve data access, modification, or disclosure, so direct impacts on GDPR or HIPAA compliance are limited. However, prolonged service unavailability could indirectly affect compliance by disrupting data processing operations.

Mitigation Strategies

Upgrade html_sanitize_ex to version 1.5.3 or later to apply the regex fix limiting property names to 64 characters.
If upgrading is not immediately possible, implement input size caps before sanitization to prevent large CSS declarations from being processed.
Use alternative functions like basic_html/1, markdown_html/1, or strip_tags/1 to avoid the vulnerable CSS scrubber.
Disable style elements and attributes in custom scrubbers to prevent routing input through the vulnerable CSS scrubber.

Hi! I’m here to help you understand CVE-2026-68749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70