CVE-2026-68749
CVE-2026-68749 is a high-severity vulnerability in Rrrene Htmlsanitizeex with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1333.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 8.2
- EPSS exploit prediction: 0% (37th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1333
- Affected product: Rrrene Htmlsanitizeex
- Published:
- Last modified:
Description
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Frequently asked questions
- What is CVE-2026-68749?
- Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
- How severe is CVE-2026-68749?
- CVE-2026-68749 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-68749 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-68749?
- CVE-2026-68749 affects Rrrene Htmlsanitizeex. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-68749?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-68749 published?
- CVE-2026-68749 was published on 2026-08-06 and last updated on 2026-08-19.
References
- https://cna.erlef.org/cves/CVE-2026-68749.html
- https://github.com/rrrene/html_sanitize_ex/commit/4f4bd9eb254881462c0461fbab74b29188c2c133
- https://github.com/rrrene/html_sanitize_ex/commit/b673df33ddf982c8bd0a8bd6348aa247080b3b14
- https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-4cx2-987x-rr2x
- https://osv.dev/vulnerability/EEF-CVE-2026-68749
Affected products (1)
- cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*
More vulnerabilities in Rrrene Htmlsanitizeex
- CVE-2026-68750 — High (CVSS 7.5): Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an…
- CVE-2026-68747 — Medium (CVSS 6.1): Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the…
- CVE-2026-66843 — Medium (CVSS 6.1): Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
- CVE-2026-66829 — Medium (CVSS 6.1): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
- CVE-2026-66370 — Medium (CVSS 6.1): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
All CVEs affecting Rrrene Htmlsanitizeex →
Other CWE-1333 vulnerabilities
- CVE-2026-35458 — Critical (CVSS 9.8): Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile…
- CVE-2023-29486 — Critical (CVSS 9.8): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass…
- CVE-2026-25547 — Critical (CVSS 9.2): @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1,…
- CVE-2023-29487 — Critical (CVSS 9.1): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS,…
- CVE-2026-71190 — High (CVSS 8.7): In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to…
- CVE-2026-57584 — High (CVSS 8.7): Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a…