CVE-2026-68749 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-68749HIGH

rrrene html_sanitize_ex — Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   N   H    8.2   .0044   36.9     —

AFFECTED
  Product           Versions                                    Fixed
  html_sanitize_ex  0.3.1 –                                     —
  html_sanitize_ex  21f90012eb21aa36f4e3701b7547e12faf0f3c8b –  4f4bd9eb254881462c0461fbab74b29188c2c133

TIMELINE
  Jul 31  Reserved by EEF
  Aug 6   Published (CNA: EEF)
  Aug 18  PATCH SHIPPED — CVE-2026-68749 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 4f4bd9eb254881462c0461fbab74b29188c2c133.

CWE-1333 · CNA: EEF · CVSS v4.0 · 5 references · NVD status: Analyzed

Description

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 31, 2026	Reserved	Reserved by EEF
August 6, 2026	Published	Published (CNA: EEF)
August 18, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-68749 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 4f4bd9eb254881462c0461fbab74b29188c2c133.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
rrrene	html_sanitize_ex	—	0.3.1	—
rrrene	html_sanitize_ex	—	21f90012eb21aa36f4e3701b7547e12faf0f3c8b	4f4bd9eb254881462c0461fbab74b29188c2c133

Weaknesses

CWE-1333

References (5)

https://cna.erlef.org/cves/CVE-2026-68749.html [related]
https://github.com/rrrene/html_sanitize_ex/commit/4f4bd9eb254881462c0461fbab74b29188c2c133 [patch]
https://github.com/rrrene/html_sanitize_ex/commit/b673df33ddf982c8bd0a8bd6348aa247080b3b14 [patch]
https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-4cx2-987x-rr2x [vendor-advisory, related]
https://osv.dev/vulnerability/EEF-CVE-2026-68749 [related]

Authoritative record: CVE-2026-68749 at cve.org

Vendors: rrrene

Weaknesses: CWE-1333

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-68749 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.