CVE-2026-128068

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128068
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128068.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128068
Aliases
Downstream
CGA (31)
DEBIAN (1)
Published
2026-11-13T17:15:56Z
Modified
2026-11-15T02:46:30Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned from each line start. An attacker who supplies HTML can cause quadratic CPU consumption when an application customizes its allowed tags to include an SVG reference element such as use and permits href or xlink:href. The default allowed tag configuration is not affected. CRuby 3.2 and later uses linear-time regular expression matching for this pattern, while CRuby 3.1 and earlier and JRuby are affected. This issue is fixed in version 1.7.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128068.json"
}
References

Affected packages

Git / github.com/rails/rails-html-sanitizer

Affected ranges

Type
GIT
Repo
https://github.com/rails/rails-html-sanitizer
Events
Introduced
5c4354db7524b1df891df0a3e29877ce9f7575ca
Fixed
bac36ce7efc155383c6eb34326c0e79d6858a799
Fixed
f776f963b9d9346271aade9cb903e793fd38e865
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.0.3"
                },
                {
                    "fixed": "1.7.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "f776f963b9d9346271aade9cb903e793fd38e865"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.7.2",
            "range": [
                {
                    "fixed": "bac36ce7efc155383c6eb34326c0e79d6858a799"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.6.0
v1.6.0.rc1
v1.6.0.rc2
v1.6.1
v1.7.0
v1.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128068.json"