SB20261109220 - Inefficient Algorithmic Complexity in Java HTML Sanitizer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109220

SB20261109220 - Inefficient Algorithmic Complexity in Java HTML Sanitizer

Published: November 9, 2026

Security Bulletin ID SB20261109220
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive CPU consumption in applications sanitizing untrusted HTML.

The vulnerability exists due to quadratic processing of duplicate attributes in Java HTML Sanitizer when the sanitization policy allows at least one attribute. An unauthenticated remote attacker can submit a single HTML tag containing many copies of an allowed attribute, causing one sanitization call to consume tens of seconds of CPU time.


Remediation

Install update from vendor's website.

References