CVE-2026-68750
Full vulnerability record from the local CVENow database.
Description
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Severity
HIGH
CVSS score
8.2
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-06 16:16:51.907000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON
{
"id": "CVE-2026-68750",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-08-06T16:16:51.907",
"lastModified": "2026-10-24T16:10:00.153",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count.\n\nThe traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de complejidad algorítmica ineficiente en el motor de recorrido en rrrene html_sanitize_ex permite a un atacante remoto no autenticado agotar la CPU y la memoria del servidor a través de una secuencia plana de elementos hermanos en HTML saneado. La cláusula de lista de HtmlSanitizeEx.Traverser.traverse/2 recursiona en la cola de una lista de hermanos y luego evalúa List.flatten([head] ++ tail) sobre el resultado ya aplanado, por lo que cada uno de n hermanos copia y vuelve a recorrer toda la cola restante. El aplanamiento solo es necesario para el caso raro en que scrub devuelve varios nodos de reemplazo para un nodo, pero el costo se paga en toda la cola en cada paso, haciendo que el recorrido sea cuadrático en el recuento de hermanos.\n\nEl recorredor se encuentra en cada punto de entrada público, por lo que no se requiere ningún depurador o configuración particular y la carga útil solo necesita etiquetas permitidas. Un cuerpo de 160 KB de 20.000 elementos hermanos ocupa un planificador durante aproximadamente 1,7 segundos, y el costo crece más rápido que el cuerpo.\n\nEste problema afecta a html_sanitize_ex: desde 0.3.1 antes de 1.5.3."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "rrrene",
"product": "html_sanitize_ex",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "html_sanitize_ex",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.HtmlSanitizeEx.Traverser'",
"'Elixir.HtmlSanitizeEx'"
],
"programFiles": [
"lib/html_sanitize_ex/traverser.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "'Elixir.HtmlSanitizeEx.Traverser':traverse/2"
},
{
"name": "'Elixir.HtmlSanitizeEx':basic_html/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':html5/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':markdown_html/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':strip_tags/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"versions": [
{
"version": "0.3.1",
"lessThan": "1.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.5.0-rc.0",
"lessThan": "1.5.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "rrrene",
"product": "html_sanitize_ex",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "rrrene/html_sanitize_ex",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.HtmlSanitizeEx.Traverser'",
"'Elixir.HtmlSanitizeEx'"
],
"programFiles": [
"lib/html_sanitize_ex/traverser.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "'Elixir.HtmlSanitizeEx.Traverser':traverse/2"
},
{
"name": "'Elixir.HtmlSanitizeEx':basic_html/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':html5/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':markdown_html/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':strip_tags/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"versions": [
{
"version": "69ea11d61525c470b39b6860d024770d5573ff1f",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "9f5ccedbed230930813f992a1e6906fcf485981e",
"status": "unaffected"
},
{
"at": "507a6fb95dd4c466cac8a8355d8989043e9fbcc1",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T15:41:21.489983Z",
"id": "CVE-2026-68750",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-407"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.3.1",
"versionEndExcluding": "1.5.3",
"matchCriteriaId": "DE85053C-AE84-4570-A90C-4D4CCD7A4BA3"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-68750.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/commit/507a6fb95dd4c466cac8a8355d8989043e9fbcc1",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-463q-p2fr-mh9p",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-68750",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
}
]
}