Is CVE-2026-68750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68750 being exploited in the wild.

How severe is CVE-2026-68750?

High severity, with a CVSS score of 7.5, published 6 August 2026.

Which products and versions are affected?

Rrrene Html Sanitize Ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3.

Is there a fix for CVE-2026-68750?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-68750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-68750?

Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68750: rrrene html_sanitize_ex algorithmic complexity DoS

CVE-2026-68750 · Severity: high · CVSS 7.5 · Published 2026-08-06

html_sanitize_ex is a library used to remove potentially malicious content from HTML input. The library contains an inefficient algorithm that causes excessive CPU and memory consumption when processing HTML with many sibling elements, allowing an unauthenticated attacker to exhaust server resources and cause service unavailability without needing special permissions or configuration.

Technologies: Rrrene Html Sanitize Ex, Rrrene Htmlsanitizeex. Vendors: Rrrene.

Quick answers

Is CVE-2026-68750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68750 being exploited in the wild.
How severe is CVE-2026-68750?: High severity, with a CVSS score of 7.5, published 6 August 2026.
Which products and versions are affected?: Rrrene Html Sanitize Ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3.
Is there a fix for CVE-2026-68750?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-68750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-68750?: Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an algorithmic complexity issue (CWE-1050) in the traversal engine of html_sanitize_ex. The Traverser.traverse/2 function recursively processes sibling elements while repeatedly calling List.flatten(), which re-evaluates and re-copies the flattened tail at each step, resulting in quadratic time complexity relative to sibling count. The traverser is on all public entry points and does not require special scrubber configuration or authentication. An attacker can craft an HTML payload with thousands of allowed sibling elements (160 KB with 20,000 siblings) to occupy a scheduler thread for extended periods; impact grows faster than payload size. Patches are available in versions 1.4.5+ and 1.5.3+.

Affected products

rrrene html_sanitize_ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.