CVE-2022-23516: Uncontrolled Recursion in Loofah
Summary
Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption.
Mitigation
Upgrade to Loofah >= 2.19.1.
Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
Severity
The Loofah maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
- CWE - CWE-674: Uncontrolled Recursion (4.9)
Other sources
An uncontrolled recursion vulnerability was found in rubygem loofah. While sanitizing certain sections, loofah is susceptible to stack exhaustion, which can result in a denial of service through CPU resource consumption.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23516?
CVE-2022-23516 is classified as a denial of service vulnerability due to potential stack exhaustion.
How do I fix CVE-2022-23516?
To fix CVE-2022-23516, upgrade to Loofah version 2.19.1 or later.
What versions of Loofah are affected by CVE-2022-23516?
Loofah versions between 2.2.0 and 2.19.0 are affected by CVE-2022-23516.
What can happen if I do not address CVE-2022-23516?
If you do not address CVE-2022-23516, your application may become susceptible to denial of service attacks due to high CPU usage.
Is CVE-2022-23516 related to any specific software?
CVE-2022-23516 specifically affects the Loofah Ruby gem.