Executive brief
html_sanitize_ex is a library used to remove potentially malicious content from HTML input. The library contains an inefficient algorithm that causes excessive CPU and memory consumption when processing HTML with many sibling elements, allowing an unauthenticated attacker to exhaust server resources and cause service unavailability without needing special permissions or configuration.
Technical details
The vulnerability is an algorithmic complexity issue (CWE-1050) in the traversal engine of html_sanitize_ex. The Traverser.traverse/2 function recursively processes sibling elements while repeatedly calling List.flatten(), which re-evaluates and re-copies the flattened tail at each step, resulting in quadratic time complexity relative to sibling count. The traverser is on all public entry points and does not require special scrubber configuration or authentication. An attacker can craft an HTML payload with thousands of allowed sibling elements (160 KB with 20,000 siblings) to occupy a scheduler thread for extended periods; impact grows faster than payload size. Patches are available in versions 1.4.5+ and 1.5.3+.
Affected products
- rrrene html_sanitize_ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3
Timeline
- 2026-08-06: disclosed