PatchTheCEVCVE-2026-68750: Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an
45
This month
HIGH 7.5REMOTEUPGRADE
CVE-2026-68750 is a high-severity flaw (CVSS 7.5) affecting htmlsanitizeex. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-wal
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 44%) |
| CISA exploited list | No |
| Weakness | CWE-407 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
rrrene htmlsanitizeex UPGRADE
Affected: >= 0.3.1 and < 1.5.3
Fixed in: 1.5.3
Safe to downgrade to: a release before 0.3.1
1. Check installed version
apt-cache policy htmlsanitizeex || rpm -q htmlsanitizeex || htmlsanitizeex --version
2. UPGRADE to 1.5.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade htmlsanitizeex
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade htmlsanitizeex
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.3.1 (Debian / Ubuntu)
apt-cache madison htmlsanitizeex
sudo apt install htmlsanitizeex=<VERSION_BEFORE_0.3.1>
sudo apt-mark hold htmlsanitizeex
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list htmlsanitizeex
sudo dnf downgrade htmlsanitizeex-<VERSION_BEFORE_0.3.1>
sudo dnf versionlock add htmlsanitizeex
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-68749 HIGH 7.5 UPGRADE Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows
- CVE-2026-66829 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
- CVE-2026-66843 MEDIUM 6.1 UPGRADE Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sa
- CVE-2026-68747 MEDIUM 6.1 UPGRADE Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerabili
- CVE-2026-66370 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz