CVE-2026-68750
CVE-2026-68750 is a high-severity vulnerability in Rrrene Htmlsanitizeex with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-407.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 8.2
- EPSS exploit prediction: 0% (37th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-407
- Affected product: Rrrene Htmlsanitizeex
- Published:
- Last modified:
Description
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Frequently asked questions
- What is CVE-2026-68750?
- Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
- How severe is CVE-2026-68750?
- CVE-2026-68750 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-68750 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-68750?
- CVE-2026-68750 affects Rrrene Htmlsanitizeex. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-68750?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-68750 published?
- CVE-2026-68750 was published on 2026-08-06 and last updated on 2026-08-19.
References
- https://cna.erlef.org/cves/CVE-2026-68750.html
- https://github.com/rrrene/html_sanitize_ex/commit/507a6fb95dd4c466cac8a8355d8989043e9fbcc1
- https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e
- https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-463q-p2fr-mh9p
- https://osv.dev/vulnerability/EEF-CVE-2026-68750
Affected products (1)
- cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*
More vulnerabilities in Rrrene Htmlsanitizeex
- CVE-2026-68749 — High (CVSS 7.5): Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an…
- CVE-2026-68747 — Medium (CVSS 6.1): Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the…
- CVE-2026-66843 — Medium (CVSS 6.1): Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
- CVE-2026-66829 — Medium (CVSS 6.1): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
- CVE-2026-66370 — Medium (CVSS 6.1): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex…
All CVEs affecting Rrrene Htmlsanitizeex →
Other CWE-407 vulnerabilities
- CVE-2026-75596 — High (CVSS 8.7): Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the…
- CVE-2026-54284 — High (CVSS 8.7): sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion…
- CVE-2026-58059 — High (CVSS 8.7): In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue…
- CVE-2026-65623 — High (CVSS 8.7): Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via…
- CVE-2026-57480 — High (CVSS 8.7): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
- CVE-2026-55206 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…