CVE-2026-68750 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-68750HIGH

rrrene html_sanitize_ex — Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   N   H    8.2   .0044   36.9     —

AFFECTED
  Product           Versions                                    Fixed
  html_sanitize_ex  0.3.1 –                                     —
  html_sanitize_ex  69ea11d61525c470b39b6860d024770d5573ff1f –  9f5ccedbed230930813f992a1e6906fcf485981e

TIMELINE
  Jul 31  Reserved by EEF
  Aug 6   Published (CNA: EEF)
  Aug 18  PATCH SHIPPED — CVE-2026-68750 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 9f5ccedbed230930813f992a1e6906fcf485981e.

CWE-407 · CNA: EEF · CVSS v4.0 · 5 references · NVD status: Analyzed

Description

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 31, 2026	Reserved	Reserved by EEF
August 6, 2026	Published	Published (CNA: EEF)
August 18, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-68750 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 9f5ccedbed230930813f992a1e6906fcf485981e.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
rrrene	html_sanitize_ex	—	0.3.1	—
rrrene	html_sanitize_ex	—	69ea11d61525c470b39b6860d024770d5573ff1f	9f5ccedbed230930813f992a1e6906fcf485981e

Weaknesses

CWE-407

References (5)

https://cna.erlef.org/cves/CVE-2026-68750.html [related]
https://github.com/rrrene/html_sanitize_ex/commit/507a6fb95dd4c466cac8a8355d8989043e9fbcc1 [patch]
https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e [patch]
https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-463q-p2fr-mh9p [vendor-advisory, related]
https://osv.dev/vulnerability/EEF-CVE-2026-68750 [related]

Authoritative record: CVE-2026-68750 at cve.org

Vendors: rrrene

Weaknesses: CWE-407

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-68750 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.