Threats tagged 'ghsa-684p-mhw3-3cwq'

CVE-2026-68750 is an inefficient algorithmic complexity vulnerability in the traversal engine of the rrrene html_sanitize_ex library. It allows an unauthenticated remote attacker to exhaust server CPU and memory by submitting sanitized HTML with a large flat run of sibling elements. The traversal function recursively flattens sibling lists inefficiently, causing quadratic time complexity relative to the number of siblings. This vulnerability affects all public entry points without requiring special configuration or scrubbers. Versions from 0.3.1 up to but not including 1.5.3, including 1.5.0-rc.0, are impacted.