CVE-2026-68749

creationtimestamp| type| source ---|---|--- 2026-08-12 03:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msu7alsv762e...

CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...