The html_sanitize_ex library is vulnerable to remote CPU and memory exhaustion attacks, potentially causing widespread service disruption.

This is an inefficient algorithmic complexity vulnerability (CWE-407) in the traversal engine. An unauthenticated remote attacker can submit HTML containing a flat run of sibling elements, forcing the library to consume excessive memory and CPU during the sanitization process.

Exploitation of this vulnerability leads to resource exhaustion, resulting in application performance degradation or complete service outages. The high CVSS score of 8.2 reflects the ease of exploitation by unauthenticated users and the severe impact on system availability, which could disrupt critical business workflows.

Immediate Action: Update the html_sanitize_ex library to version 1.5.3 or the latest patched version provided by the vendor.

Proactive Monitoring: Monitor memory and CPU usage on application servers and analyze logs for payloads containing abnormally high numbers of sibling HTML elements.

Compensating Controls: Implement input length limits and structural validation at the application level to reject excessively large or deeply nested HTML structures before they reach the sanitizer.

Public Exploit Available: No

Due to the ease of triggering this resource exhaustion flaw, organizations should treat this as a priority update. Applying the vendor-supplied patch is the only effective way to remediate the underlying algorithmic inefficiency.