The vulnerability in html_sanitize_ex's traversal engine is due to inefficient handling of sibling elements during HTML sanitization. Specifically, the list clause of HtmlSanitizeEx.Traverser.traverse/2 recursively processes the tail of a sibling list and then flattens the combined list, causing repeated copying and re-walking of the tail. This results in quadratic time complexity in the number of siblings, enabling an attacker to exhaust server CPU and memory resources by submitting HTML with many sibling elements. The traverser is invoked on every public entry point, requiring no special scrubber or configuration, and the attack payload only needs allowed tags. The issue affects versions from 0.3.1 before 1.5.3.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service by exhausting server CPU and memory resources. The traversal engine's quadratic complexity means that large inputs with many sibling elements can significantly degrade server performance. There is no impact on confidentiality or integrity, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.5.3, upgrading to version 1.5.3 or later is likely the intended fix. Until a patch is applied, consider limiting the size or complexity of HTML inputs to mitigate potential resource exhaustion.