---
id: "CVE-2026-126205"
page: "https://infrastack.ai/live/CVE-2026-126205"
kind: "vulnerability"
aliases: ["CVE-2026-126205", "GHSA-mf2j-8f84-cc9q"]
title: "Loofah: Regular expression denial of service in the SVG local-reference check"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "loofah", "fixed": ["2.25.3"], "affected": "< 2.25.3", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-1333", "cwe-400", "html-sanitization", "loofah", "package", "rails", "ruby"]
not_affected_if: ["no-untrusted-html", "ruby-3.2-or-later"]
published_at: "2026-11-12T21:00:42+00:00"
first_seen_at: "2026-11-12T21:03:58+00:00"
updated_at: "2026-11-12T21:04:36+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mf2j-8f84-cc9q", "first_seen_at": "2026-11-12T21:03:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126205", "first_seen_at": "2026-11-12T21:40:31+00:00"}]
exploit_sources: []
---

# Loofah: Regular expression denial of service in the SVG local-reference check

Link for people: https://infrastack.ai/live/CVE-2026-126205 (this .md is for agents)

Loofah's HTML sanitizer checks SVG href and xlink:href values with a regular expression that takes time quadratic in the value's length on Ruby 3.1 and earlier. An attacker who submits HTML with a long run of whitespace in such an attribute can consume server CPU out of proportion to the input size.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:loofah affected < 2.25.3 fixed 2.25.3

## How to check

- Run `ruby --version` and check whether it reports 3.1 or earlier.
- Run `bundle exec ruby -e "require 'loofah'; puts Loofah::VERSION"` or check Gemfile.lock for `loofah` below `2.25.3`.
- Find where your application passes untrusted HTML into Loofah sanitization.

## Fix

- Upgrade `loofah` to `2.25.3` or later.
- Applications that cannot upgrade should run Ruby `3.2` or later, which matches the pattern in linear time.

## Timeline

- 2026-11-12T21:03:58+00:00 ghsa https://github.com/advisories/GHSA-mf2j-8f84-cc9q
- 2026-11-12T21:40:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126205

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/flavorjones/loofah/security-advisories/GHSA-mf2j-8f84-cc9q
- [advisory] Maintainer's advisory: github.com https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q
- [fix] Patch: github.com https://github.com/flavorjones/loofah/pull/324
- [fix] Patch: github.com https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1
- [fix] Release notes: github.com https://github.com/flavorjones/loofah/releases/tag/v2.25.3

## From the sources

## Summary

Loofah's HTML5 sanitizer restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\s*[^#\s].*/m`. In Ruby `^` anchors to every line start and `\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.

Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.

## Impact

An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.

The default safelist allows the elements in `SVG_ALLOW_LOCAL_HREF`, so no configuration change is required.

## Mitigation

Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.

## Credit

Reported by scyoon through the Rails HackerOne program.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_