GHSA-mf2j-8f84-cc9q

Suggest an improvement
Source
https://github.com/advisories/GHSA-mf2j-8f84-cc9q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mf2j-8f84-cc9q
Aliases
  • CVE-2026-126205
Published
2026-11-12T21:00:42Z
Modified
2026-11-12T21:15:10Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Loofah: Regular expression denial of service in the SVG local-reference check
Details

Summary

Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.

Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.

Impact

An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.

The default safelist allows the elements in SVG_ALLOW_LOCAL_HREF, so no configuration change is required.

Mitigation

Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.

Credit

Reported by scyoon through the Rails HackerOne program.

Database specific 
{
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T21:00:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

RubyGems / loofah

Package

Name
loofah
Purl
pkg:gem/loofah

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.3

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
1.*
1.0.0.beta.1
1.0.0
1.1.0
1.2.0
1.2.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0.rc1
2.1.0.rc2
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.19.1
2.20.0
2.21.0.rc1
2.21.0
2.21.1
2.21.2
2.21.3
2.21.4
2.22.0
2.23.0
2.23.1
2.24.0
2.24.1
2.25.0
2.25.1
2.25.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json"