The vulnerability in rrrene html_sanitize_ex arises from the traversal engine's inefficient handling of sibling elements during HTML sanitization. Specifically, the HtmlSanitizeEx.Traverser.traverse/2 function recursively processes the tail of sibling lists and repeatedly flattens the combined list, resulting in quadratic time complexity. This inefficiency can be exploited by an unauthenticated remote attacker to cause excessive CPU and memory consumption on the server by submitting sanitized HTML containing a large number of sibling elements. The traversal engine is invoked on every public entry point, so no special scrubber or configuration is needed to trigger the issue. The vulnerability affects versions >=0.3.1 and <1.5.3, including 0.3.1 and 1.5.0-rc.0. A test payload with 20,000 sibling elements can occupy a scheduler for approximately 1.7 seconds, with resource usage growing faster than the payload size.

An unauthenticated remote attacker can exploit this vulnerability to cause denial of service by exhausting server CPU and memory resources. The quadratic complexity in processing sibling elements can degrade server performance significantly, potentially leading to service disruption. There is no requirement for special tags or configurations, making exploitation straightforward if the vulnerable versions are used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor the vendor's announcements for updates addressing this issue. Until a fix is available, consider limiting the size and complexity of HTML inputs processed by html_sanitize_ex or applying rate limiting to mitigate potential denial of service attacks.