Inefficient regular expression complexity in rails-html-sanitizer - #VU161894
Published: November 8, 2026
Vulnerability identifier: #VU161894
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade application availability through excessive CPU consumption.
The vulnerability exists due to quadratic regular expression matching in rails-html-sanitizer's SVG reference checks on JRuby or CRuby before 3.2 when custom rules allow SVG reference elements and reference attributes. An unauthenticated remote attacker can submit HTML containing an SVG reference element with a long whitespace-only href or xlink:href value to trigger disproportionate processing time.
Affected software
rails-html-sanitizer
Remediation
Install security update from vendor's website.
rails-html-sanitizer - update to 1.7.2