The vulnerability in rrrene html_sanitize_ex's CSS scrubber (HtmlSanitizeEx.Scrubber.CSS.scrub/1) is due to an inefficient regular expression that matches CSS property names with an unbounded greedy pattern followed by a mandatory colon. When a long run of word characters without a colon is processed, the regex engine performs backtracking that results in quadratic time complexity relative to the input length. This can be exploited remotely without authentication by submitting a long CSS declaration in sanitized HTML, causing significant CPU exhaustion on the server. The issue affects html_sanitize_ex versions from 0.3.1 before 1.5.3. The impact is denial of service through resource exhaustion only, with no confidentiality or integrity compromise.

The vulnerability causes CPU exhaustion on the server processing the CSS scrubber, potentially leading to application unresponsiveness or denial of service. No data confidentiality, integrity, or availability beyond CPU resource exhaustion is affected. The attack requires no authentication and can be triggered remotely by sending specially crafted CSS declarations in sanitized HTML inputs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the size of CSS inputs passed to the scrubber or implementing application-level request rate limiting to reduce the risk of CPU exhaustion. Monitor application responsiveness and resource usage to detect potential exploitation attempts.