The html_sanitize_ex library contains a high-severity vulnerability that allows remote, unauthenticated attackers to cause denial of service through CPU exhaustion.

This is an inefficient regular expression complexity vulnerability (CWE-1333) located in the CSS scrubber component. An unauthenticated remote attacker can supply a specially crafted, long CSS declaration within sanitized HTML to cause excessive resource consumption.

Successful exploitation results in a denial of service by exhausting server CPU resources. This can lead to system instability, application downtime, and service unavailability for legitimate users. Given the high CVSS score of 8.2, this flaw poses a significant risk to the availability of any infrastructure utilizing this library for HTML sanitization.

Immediate Action: Update the html_sanitize_ex library to version 1.5.3 or the latest patched version referenced in the vendor advisory.

Proactive Monitoring: Monitor server CPU utilization metrics and inspect web server logs for abnormally long or complex CSS strings in user-submitted HTML inputs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to limit the length and complexity of CSS inputs processed by the application.

Public Exploit Available: No

This vulnerability represents a critical availability risk for applications relying on html_sanitize_ex. Security teams should prioritize patching to the latest version immediately to prevent potential denial of service attacks that could disrupt business operations.