{"id":"CVE-2026-128068","kind":"vulnerability","aliases":["CVE-2026-128068","GHSA-cpgf-5mjf-73p7"],"related":[],"title":"rails-html-sanitizer: Possible regular expression denial of service with certain configurations","description":"## Summary\n\n`Rails::HTML::PermitScrubber` restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\\s*[^#\\s].*/m`. In Ruby `^` anchors to every line start and `\\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.\n\n- Versions affected: `>= 1.0.3, < 1.7.2`\n- Not affected: `< 1.0.3`\n- Fixed versions: `1.7.2`\n\nOnly Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.\n\n## Impact\n\nAn attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.\n\nApplications are affected only when the allowed tags are overridden to include an SVG reference element such as `use`, along with `href` or `xlink:href` in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3.\n\n## Workarounds\n\nRun Ruby 3.2 or later, which matches the pattern in linear time, or remove the SVG reference elements from the overridden allowed tags.\n\n## Credit\n\nReported by scyoon through the Rails HackerOne program.","summary":"rails-html-sanitizer's PermitScrubber uses a regular expression that takes quadratic time on long runs of whitespace in SVG href attributes. An attacker who submits such HTML can consume CPU out of proportion to the input size, slowing or stalling the sanitizing process.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rails-html-sanitizer","fixed":["1.7.2"],"affected":">= 1.0.3, < 1.7.2","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-1333","cwe-400","loofah","package","rails","rails-html-sanitizer","ruby"],"not_affected_if":["default-config","managed-hosting","ruby-3.2-or-later"],"how_to_check":"- Run `ruby --version`; affected only on Ruby 3.1 and earlier, since Ruby 3.2 and later match the pattern in linear time.\n- Check the Gemfile.lock for `rails-html-sanitizer` between `1.0.3` and `1.7.2` (exclusive of `1.7.2`).\n- Search the app for overrides of the sanitizer's allowed tags that add `use` (an SVG reference element) together with `href` or `xlink:href` in allowed attributes.\n- Check whether Loofah is used directly, since its own copy of the check is affected until Loofah `2.25.3`.","fix":"- `rails-html-sanitizer` `1.7.2`\n- Loofah `2.25.3` for applications that use Loofah directly\n- Alternatively, run Ruby 3.2 or later","status":"open","published_at":"2026-11-13T17:54:38+00:00","first_seen_at":"2026-11-13T17:56:44+00:00","triaged_at":"2026-11-13T17:57:01+00:00","updated_at":"2026-11-13T17:57:01+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T17:57:01Z","model":"claude-haiku-5-5","output":{"fix":"- `rails-html-sanitizer` `1.7.2`\n- Loofah `2.25.3` for applications that use Loofah directly\n- Alternatively, run Ruby 3.2 or later","reach":"internet","title":"rails-html-sanitizer: whitespace input can stall the server with a ReDoS","impact":"low","summary":"rails-html-sanitizer's PermitScrubber uses a regular expression that takes quadratic time on long runs of whitespace in SVG href attributes. An attacker who submits such HTML can consume CPU out of proportion to the input size, slowing or stalling the sanitizing process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rails","ruby","rails-html-sanitizer","loofah"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"CPU exhaustion from crafted HTML input, slowing or stalling requests","analyst_note":"","how_to_check":"- Run `ruby --version`; affected only on Ruby 3.1 and earlier, since Ruby 3.2 and later match the pattern in linear time.\n- Check the Gemfile.lock for `rails-html-sanitizer` between `1.0.3` and `1.7.2` (exclusive of `1.7.2`).\n- Search the app for overrides of the sanitizer's allowed tags that add `use` (an SVG reference element) together with `href` or `xlink:href` in allowed attributes.\n- Check whether Loofah is used directly, since its own copy of the check is affected until Loofah `2.25.3`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","ruby-3.2-or-later","managed-hosting"],"who_is_affected":"Applications are exposed only when the allowed tags are overridden to include an SVG reference element such as `use`, along with `href` or `xlink:href` in allowed attributes, and only on Ruby 3.1 or earlier. The default configuration includes no SVG elements and is not affected. Teams that use Loofah directly should check its own copy of the check.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000897,"input_tokens":5106,"output_tokens":773,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128068':16A,24A '-1333':30B '-2026':15A,23A '-400':32B '/m':113C '1.0.3':151C,155C '1.7.2':152C,158C '2.25.3':276C '3.1':161C '3.2':167C,280C '5mjf':20A '73p7':21A 'add':168C 'affect':150C,154C,165C,217C,258C 'all-whitespac':127C 'allow':221C,242C,246C,299C 'along':234C 'anchor':116C 'applic':215C,259C 'attack':65B,181C 'attribut':63B,96C,108C,243C 'certain':12A 'check':105C,272C 'configur':13A,255C 'consum':71B,189C 'copi':269C 'cpgf':19A 'cpu':72B,190C 'credit':301C 'cve':14A,22A 'cwe':29B,31B 'default':245C,254C 'denial':8A 'direct':263C 'earlier':163C 'element':100C,203C,230C,251C,295C 'engin':133C 'everi':118C 'expos':265C 'express':7A,50B 'fix':156C,273C 'ghsa':18A 'ghsa-cpgf-5mjf-73p7':17A 'hackeron':308C 'href':62B,92C,95C,205C,208C,236C,239C 'html':3A,27A,38B,43B,69B,88C,184C 'impact':179C 'includ':226C,248C 'input':78B,196C 'later':282C 'length':148C 'line':119C,141C 'linear':170C,178C,288C 'linear-tim':169C 'local':102C 'long':56B,211C 'loofah':33B,262C,275C 'made':131C 'make':175C 'match':106C,123C,173C,284C 'newlin':124C 'overridden':224C,298C 'packag':34B 'pattern':177C,286C 'permitscrubb':46B,89C 'possibl':5A 'process':85B 'program':309C 'proport':75B,193C 'quadrat':53B,145C 'rail':2A,35B,37B,42B,87C,307C 'rails':26A 'rails-html-sanit':1A,36B,41B 'rails-html-sanitizer':25A 'refer':99C,103C,202C,229C,294C 'regexp':172C 'regular':6A,49B 'remov':291C 'report':302C 'rescan':134C 'restrict':90C 'rubi':40B,115C,160C,166C,279C 'run':57B,212C,278C 'sanit':4A,39B,44B,84B,187C 'sanitizer':28A 'scyoon':304C 'send':199C 'servic':10A 'size':79B,197C 'slow':80B 'stall':82B 'start':120C,142C 'submit':67B 'summari':86C 'suppli':183C 'svg':61B,98C,201C,228C,250C,293C 'tag':222C,247C,300C 'take':52B,143C 'time':54B,144C,171C,289C 'use':47B,233C,261C 'valu':109C,130C,136C 'version':149C,157C 'whitespac':59B,129C,214C 'whose':204C 'workaround':277C 'xlink':94C,207C,238C","nicknames":[],"mitigations":[],"who_affected":"Applications are exposed only when the allowed tags are overridden to include an SVG reference element such as `use`, along with `href` or `xlink:href` in allowed attributes, and only on Ruby 3.1 or earlier. The default configuration includes no SVG elements and is not affected. Teams that use Loofah directly should check its own copy of the check.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["railshtmlsanitizer"],"ptokens":["html","rails","sanitizer"],"labels":["cwe1333","cwe400","loofah","medium","package","rails","railshtmlsanitizer","ruby","rubygems"],"campaign_type":null,"search_a":"'-128068':16A,24A '-2026':15A,23A '5mjf':20A '73p7':21A 'certain':12A 'configur':13A 'cpgf':19A 'cve':14A,22A 'denial':8A 'express':7A 'ghsa':18A 'ghsa-cpgf-5mjf-73p7':17A 'html':3A,27A 'possibl':5A 'rail':2A 'rails':26A 'rails-html-sanit':1A 'rails-html-sanitizer':25A 'regular':6A 'sanit':4A 'sanitizer':28A 'servic':10A","search_b":"'-1333':30B '-400':32B 'attack':65B 'attribut':63B 'consum':71B 'cpu':72B 'cwe':29B,31B 'express':50B 'href':62B 'html':38B,43B,69B 'input':78B 'long':56B 'loofah':33B 'packag':34B 'permitscrubb':46B 'process':85B 'proport':75B 'quadrat':53B 'rail':35B,37B,42B 'rails-html-sanit':36B,41B 'regular':49B 'rubi':40B 'run':57B 'sanit':39B,44B,84B 'size':79B 'slow':80B 'stall':82B 'submit':67B 'svg':61B 'take':52B 'time':54B 'use':47B 'whitespac':59B","search_c":"'/m':113C '1.0.3':151C,155C '1.7.2':152C,158C '2.25.3':276C '3.1':161C '3.2':167C,280C 'add':168C 'affect':150C,154C,165C,217C,258C 'all-whitespac':127C 'allow':221C,242C,246C,299C 'along':234C 'anchor':116C 'applic':215C,259C 'attack':181C 'attribut':96C,108C,243C 'check':105C,272C 'configur':255C 'consum':189C 'copi':269C 'cpu':190C 'credit':301C 'default':245C,254C 'direct':263C 'earlier':163C 'element':100C,203C,230C,251C,295C 'engin':133C 'everi':118C 'expos':265C 'fix':156C,273C 'hackeron':308C 'href':92C,95C,205C,208C,236C,239C 'html':88C,184C 'impact':179C 'includ':226C,248C 'input':196C 'later':282C 'length':148C 'line':119C,141C 'linear':170C,178C,288C 'linear-tim':169C 'local':102C 'long':211C 'loofah':262C,275C 'made':131C 'make':175C 'match':106C,123C,173C,284C 'newlin':124C 'overridden':224C,298C 'pattern':177C,286C 'permitscrubb':89C 'program':309C 'proport':193C 'quadrat':145C 'rail':87C,307C 'refer':99C,103C,202C,229C,294C 'regexp':172C 'remov':291C 'report':302C 'rescan':134C 'restrict':90C 'rubi':115C,160C,166C,279C 'run':212C,278C 'sanit':187C 'scyoon':304C 'send':199C 'size':197C 'start':120C,142C 'summari':86C 'suppli':183C 'svg':98C,201C,228C,250C,293C 'tag':222C,247C,300C 'take':143C 'time':144C,171C,289C 'use':233C,261C 'valu':109C,130C,136C 'version':149C,157C 'whitespac':129C,214C 'whose':204C 'workaround':277C 'xlink':94C,207C,238C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T06:07:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-cpgf-5mjf-73p7","url":"https://github.com/advisories/GHSA-cpgf-5mjf-73p7","severity":"medium","published_at":"2026-11-13T17:54:38+00:00","modified_at":"2026-11-13T17:54:38+00:00","first_seen_at":"2026-11-13T17:56:44+00:00","fetched_at":"2026-11-13T18:07:02+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128068","severity":null,"published_at":"2026-11-13T18:17:34+00:00","modified_at":"2026-11-13T18:17:34+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:32+00:00","note":null}],"documents":[{"id":148174,"url":"https://api.github.com/repos/rails/rails-html-sanitizer/security-advisories/GHSA-cpgf-5mjf-73p7","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":148175,"url":"https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-02T06:07:34+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":148176,"url":"https://github.com/rails/rails-html-sanitizer/commit/f776f963b9d9346271aade9cb903e793fd38e865","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148177,"url":"https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}