LOOFAH · CVE-2026-126205 · Package
FIX → 2.25.3
Loofah's HTML sanitizer checks SVG href and xlink:href values with a regular expression that takes time quadratic in the value's length on Ruby 3.1 and earlier. An attacker who submits HTML with a long run of whitespace in such an attribute can consume server CPU out of proportion to the input size.
first public Nov 2, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use Loofah to sanitize user-supplied HTML are exposed when they run Ruby 3.1 or earlier, because the affected check runs on every SVG reference element with an href or xlink:href value. The default safelist allows those elements, so no special configuration is needed. Systems on Ruby 3.2 or later, or that never sanitize untrusted HTML, can skip it.
Not affected if no-untrusted-html, ruby-3.2-or-later
Who cares html-sanitization, loofah, rails, ruby
ruby --version and check whether it reports 3.1 or earlier.bundle exec ruby -e "require 'loofah'; puts Loofah::VERSION" or check Gemfile.lock for loofah below 2.25.3.Upgrade to 2.25.3
Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.
Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.
An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.
The default safelist allows the elements in SVG_ALLOW_LOCAL_HREF, so no configuration change is required.
Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
loofah to 2.25.3 or later.3.2 or later, which matches the pattern in linear time.Reported by scyoon through the Rails HackerOne program.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.