CVE-2026-68749

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

• CWE-1333

• https://cna.erlef.org/cves/CVE-2026-68749.htmlPatch, Third Party Advisory
• https://github.com/rrrene/html_sanitize_ex/commit/4f4bd9eb254881462c0461fbab74b29188c2c133Patch
• https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-4cx2-987x-rr2xBroken Link
• https://osv.dev/vulnerability/EEF-CVE-2026-68749Patch, Third Party Advisory

Published

Aug 6, 2026

Last Modified

Aug 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6874A vulnerability was determined in ericc-ch copilot-api up to…4.3
• CVE-2026-68742A flaw was found in SSSD. The sss_nss_protocol_parse_addr() …5.5
• CVE-2026-68743A flaw was found in SSSD. The extract_authtok_v1() function …5.5
• CVE-2026-68744A flaw was found in SSSD. The sss_nss_protocol_fill_initgr()…3.3
• CVE-2026-68746Not Failing Securely ('Failing Open') vulnerability in liveb…8.8
• CVE-2026-68747Improper Neutralization of Special Elements in Output Used b…6.1
• CVE-2026-6875ServiceNow has addressed a remote code execution vulnerabili…9.5
• CVE-2026-68750Inefficient Algorithmic Complexity vulnerability in the trav…7.5
• CVE-2026-68752A Project Resource Manager may gain broader administrative p…7.2
• CVE-2026-68753An unauthenticated user may access restricted Artifactory co…5.3
• CVE-2026-68754A repository publisher without delete permission may modify …6.5
• CVE-2026-68755A bundle writer may create misleading release promotion info…4.3