The vulnerability arises from the traversal engine in rrrene's html_sanitize_ex library, specifically in the HtmlSanitizeEx.Traverser.traverse/2 function. This function recursively processes the tail of sibling elements and applies List.flatten on the concatenation of the head and tail, causing repeated copying and re-walking of the tail. This results in quadratic time complexity relative to the number of sibling elements. The traversal engine is invoked on every public entry point without requiring specific scrubber configurations, meaning an attacker only needs to supply allowed tags. For example, a payload with 20,000 sibling elements can occupy a scheduler for approximately 1.7 seconds, with resource consumption growing faster than the input size. The affected versions are from 0.3.1 before 1.5.3.

An unauthenticated remote attacker can exploit this vulnerability to cause denial of service by exhausting server CPU and memory resources. The inefficient traversal leads to excessive computation time and memory usage, potentially degrading or disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor the vendor's announcements for updates and consider limiting the size or complexity of HTML inputs as a temporary measure.