The vulnerability in rrrene html_sanitize_ex arises from an inefficient regular expression used in HtmlSanitizeEx.Scrubber.CSS.scrub/1 to match CSS property names. The regex uses an unbounded greedy character class followed by a mandatory colon, causing the regex engine to backtrack extensively on long runs of characters without a colon. This leads to quadratic time complexity in processing the CSS input. An attacker can exploit this by submitting a long CSS declaration in sanitized HTML, resulting in significant CPU consumption and potential denial of service by saturating the BEAM scheduler pool. The issue affects versions from 0.3.1 before 1.5.3. The impact is CPU exhaustion only, with no confidentiality or integrity compromise.

The vulnerability allows an unauthenticated remote attacker to exhaust server CPU resources by submitting specially crafted long CSS declarations in sanitized HTML. This causes the application to become unresponsive due to scheduler saturation. There is no impact on data confidentiality or integrity, as no data is read, modified, or disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the size of CSS input passed to the scrubber or implementing request rate limiting to reduce the risk of CPU exhaustion. Monitor application responsiveness to detect potential exploitation attempts.