AIKIDO-2026-837633
html_sanitize_ex is vulnerable to Denial of Service (DoS)
71
High Risk
This Affects:
html_sanitize_exTL;DR
The traversal engine processes a node's sibling list by recursing on the tail and then calling List.flatten over the already flattened result, so each of n siblings copies and re-walks the entire remaining tail. This makes traversal quadratic in the number of siblings, and the traverser runs on every public entry point regardless of which scrubber is used. Sanitizing HTML that contains a large flat run of allowed sibling elements exhausts CPU and memory and can make the service unresponsive. The fix removes the redundant re-flattening so traversal cost is linear.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
html_sanitize_ex is vulnerable to Denial of Service (DoS) in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant