Inefficient regular expression complexity in Loofah - #VU159823
Published: November 6, 2026
Vulnerability identifier: #VU159823
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade application availability through excessive CPU consumption.
The vulnerability exists due to quadratic regular expression matching in Loofah's HTML5 sanitizer SVG local-reference check on JRuby or CRuby without linear-time matching. An unauthenticated remote attacker can submit HTML containing an SVG reference element with a long, newline-containing whitespace value in its href or xlink:href attribute, triggering excessive processing under the default configuration.
Affected software
Loofah
Remediation
Install security update from vendor's website.
Loofah - update to 2.25.3