The vulnerability in html_sanitize_ex's traversal engine is due to the list clause of HtmlSanitizeEx.Traverser.traverse/2 recursively processing the tail of sibling nodes and repeatedly flattening the list, resulting in quadratic time complexity relative to the number of sibling elements. Because the traverser is invoked on every public entry point and does not require special scrubber configurations, an unauthenticated remote attacker can exhaust server CPU and memory resources by submitting sanitized HTML containing a large flat run of sibling elements. For example, a 160 KB payload with 20,000 sibling elements can occupy a scheduler for approximately 1.7 seconds, with resource consumption growing faster than the payload size.

An unauthenticated remote attacker can cause denial of service by exhausting server CPU and memory resources through specially crafted HTML payloads containing many sibling elements. This can degrade or disrupt service availability due to the quadratic traversal cost in the vulnerable versions of html_sanitize_ex.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, consider limiting the size or complexity of HTML inputs processed by html_sanitize_ex to reduce the risk of resource exhaustion.