Inefficient Algorithmic Complexity in Java HTML Sanitizer - #VU163171
Published: November 9, 2026
Vulnerability identifier: #VU163171
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive CPU consumption in applications sanitizing untrusted HTML.
The vulnerability exists due to quadratic processing of duplicate attributes in Java HTML Sanitizer when the sanitization policy allows at least one attribute. An unauthenticated remote attacker can submit a single HTML tag containing many copies of an allowed attribute, causing one sanitization call to consume tens of seconds of CPU time.
Affected software
Java HTML Sanitizer
Remediation
Install security update from vendor's website.
Java HTML Sanitizer - update to 20261031.1