CVE-2026-126205

Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.25.3

Description The HTML5 sanitizer in Loofah contains a flaw when checking href and xlink:href attributes on elements within SVG ALLOW LOCAL HREF. The sanitizer uses a regular expression where the line anchor and newline-matching whitespace cause all-whitespace values to be rescanned from every line start. An attacker can exploit this by submitting an SVG reference element with a long multiline-whitespace attribute, leading to quadratic CPU consumption during the sanitization process. This issue affects JRuby and CRuby 3.1 and earlier, whereas CRuby 3.2 and later are not affected due to the implementation of linear-time regular-expression matching.

Recommendations Update to version 2.25.3 or later. Run the application on Ruby 3.2 or later.