The vulnerability in html_sanitize_ex's CSS scrubber is due to an inefficient regular expression in HtmlSanitizeEx.Scrubber.CSS.scrub/1. The regex matches CSS property names with an unbounded greedy pattern followed by a mandatory colon. When a long sequence of word characters is not followed by a colon, the regex engine backtracks extensively, causing quadratic CPU time relative to input length. This allows an attacker to exhaust server CPU resources by submitting long CSS declarations in sanitized HTML. The impact is limited to CPU exhaustion, causing denial of service without data compromise. The affected versions include all releases from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

The vulnerability causes CPU exhaustion on the server processing sanitized HTML containing long CSS declarations. This can lead to denial of service by saturating the BEAM scheduler pool and making the application unresponsive. There is no impact on data confidentiality, integrity, or availability beyond service disruption. No data is read, modified, or disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the size of CSS input passed to the sanitizer or applying external rate limiting to mitigate potential denial of service. Monitor application responsiveness to detect potential exploitation attempts.