From afac176e996d2356481564bef5213a0a245b146c Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Thu, 24 Sep 2026 18:52:23 -0700 Subject: [PATCH] Record GHSA-x6fc-6qh4-g3wr The advisory is published with release 20260924.1, which drops CSS declarations that nest functions deeper than sixteen and removes two quadratic paths in the CSS lexer and depth scan. List it in docs/vulnerabilities.md. Co-Authored-By: Claude Fable 5.1 --- docs/vulnerabilities.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/vulnerabilities.md b/docs/vulnerabilities.md index f88f48d4..4fa85655 100644 --- a/docs/vulnerabilities.md +++ b/docs/vulnerabilities.md @@ -1,5 +1,6 @@ # Known & public vulnerabilities in this project + * [GHSA-x6fc-6qh4-g3wr](https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-x6fc-6qh4-g3wr) - 24 Sep. 2026 - Moderate severity; denial of service via deeply nested CSS functions in style attributes, affects only policies that allow styling. Recommend upgrade to v20260924.1 or later. * [GHSA-6rfr-g8xv-xrp3](https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-6rfr-g8xv-xrp3) - 22 Sep. 2026 - Low severity; affects only policies that allow URLs in styles. Recommend upgrade to v20260922.1 or later. * [GHSA-vqwm-jvq2-mfwc](https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-vqwm-jvq2-mfwc) - 22 Sep. 2026 - Incomplete fix of CVE-2025-66021. Recommend upgrade to v20260921.1 or later. * [CVE-2025-66021](https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2) - 25 Nov. 2025 - Recommend upgrade to v20260921.1 or later. The first fix, in v20260101.1, was incomplete (GHSA-vqwm-jvq2-mfwc).