CVE-2026-68749: Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows

This month

HIGH 7.5REMOTEUPGRADE

CVE-2026-68749 is a high-severity flaw (CVSS 7.5) affecting htmlsanitizeex. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one cha

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.8% (top 44%)
CISA exploited list	No
Weakness	CWE-1333
Published	2026-08-06
Last modified	2026-10-23

Publisher (CNA): EEF · Vendor: rrrene

Am I affected?

Timeline

2026-08-06 16:16 UTCPublished CVE record published
2026-10-23 21:10 UTCUpdated Record last modified

rrrene htmlsanitizeex UPGRADE

Affected: >= 0.3.1 and < 1.5.3

Fixed in: 1.5.3

Safe to downgrade to: a release before 0.3.1

1. Check installed version

apt-cache policy htmlsanitizeex || rpm -q htmlsanitizeex || htmlsanitizeex --version

2. UPGRADE to 1.5.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade htmlsanitizeex

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade htmlsanitizeex

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 0.3.1 (Debian / Ubuntu)

apt-cache madison htmlsanitizeex sudo apt install htmlsanitizeex=<VERSION_BEFORE_0.3.1> sudo apt-mark hold htmlsanitizeex

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list htmlsanitizeex sudo dnf downgrade htmlsanitizeex-<VERSION_BEFORE_0.3.1> sudo dnf versionlock add htmlsanitizeex

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source

sudo dnf upgrade --advisory=FEDORA-2026-95888f332b

Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source

sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: Hunt-Benito/the-sanitizer-is-the-weapon-cve-2026-68749-cve-2026-68750-quadratic-dos-in-elixir-html-sanitize-ex (0 stars)

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2026-68750 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an
CVE-2026-66829 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
CVE-2026-66843 MEDIUM 6.1 UPGRADE Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sa
CVE-2026-68747 MEDIUM 6.1 UPGRADE Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerabili
CVE-2026-66370 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz

References

← Back to latest CVEs