html_sanitize_ex versions prior to 1.5.3 contain a ReDoS vulnerability in the CSS sanitization regex. The library uses a greedy quantifier pattern to strip dangerous CSS declarations, but certain malformed input sequences cause quadratic backtracking—each additional character in the input doubles the processing time. There is no length constraint on the CSS input the library accepts, so an attacker can supply a style block (e.g., 80KB of specially crafted CSS) that will saturate a BEAM scheduler.
This matters more in Elixir/Erlang than in thread-based runtimes. When a BEAM scheduler saturates, it doesn't just slow down the html_sanitize call—it degrades every process sharing that scheduler, including unrelated GenServers and Phoenix endpoints. The CVSS captures individual impact, but the actual failure cascade is node-wide.
You should do three things now. First, check your dependency tree for html_sanitize_ex and upgrade to 1.5.3 when the patch releases. Second, apply a length cap on any HTML or CSS content before passing it to the sanitizer as defense-in-depth—something like 16KB is generous for real-world HTML and will truncate attack surface. Third, instrument your application for CPU saturation: if a single request causes sustained high CPU across the node, that's the signature of this exploitation.
The deeper problem is architectural. Regex is a finite state machine; CSS is a context-free grammar. The library was written with the assumption that regex matching is O(n) and therefore bounded. That assumption is false under adversarial input, and it only manifests when someone probes exactly the inputs the sanitizer was designed to process. This is a known failure class—ReDoS via unbounded greedy quantifiers has hit Python, Ruby, Node, and others—but each ecosystem inherits the vulnerability anew because the fix (possessive quantifiers) propagates without the causal reasoning. In BEAM, the cost of getting this wrong isn't just slower requests; it's cascading unavailability across every process on the node. Treat any library that processes untrusted input as a potential scheduler bomb, and enforce input bounds at your application boundary regardless of what the library promises.