CVE-2026-126205: Loofah: Regular expression denial of service in the SVG local-reference check
Summary
Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s[^#\s]./m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.
Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.
Impact
An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.
The default safelist allows the elements in SVGALLOWLOCALHREF, so no configuration change is required.
Mitigation
Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.
Credit
Reported by scyoon through the Rails HackerOne program.
Other sources
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching whitespace cause an all-whitespace value to be rescanned from every line start. An attacker can submit an SVG reference element with a long multiline-whitespace attribute and consume CPU quadratically during sanitization. CRuby 3.1 and earlier and JRuby are affected, while CRuby 3.2 and later uses linear-time regular-expression matching. The default safelist reaches the vulnerable check without a configuration change. This issue is fixed in version 2.25.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Rubyto a version that resolves this vulnerability.Fixed in 3.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Loofah's HTML5 sanitizer on Ruby 3.1 or earlier are affected when they sanitize attacker-supplied HTML. The default safelist permits the relevant SVG elements, so a configuration change is not required for exposure.
What does an attacker need to send to trigger the issue?
An attacker must be able to supply HTML that the application passes to Loofah's sanitizer. The triggering input is an SVG reference element with an href or xlink:href attribute containing a long run of whitespace.
What is the impact of successful exploitation?
The attacker can cause CPU consumption disproportionate to the input size, potentially degrading availability. The affected regular-expression behavior takes quadratic time on all-whitespace attribute values.
What can be done if Loofah cannot be upgraded immediately?
Run the application on Ruby 3.2 or later, where the regular-expression matching behavior is linear for this pattern. The primary remediation is upgrading Loofah to version 2.25.3 or later.