{"affected":[{"product":"loofah","source":"CNA: GitHub_M","vendor":"flavorjones","versions":[{"status":"affected","version":"< 2.25.3"}]}],"cveId":"CVE-2026-126205","cwes":["CWE-400","CWE-1333"],"description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG_ALLOW_LOCAL_HREF with a regular expression whose line anchor and newline-matching whitespace cause an all-whitespace value to be rescanned from every line start. An attacker can submit an SVG reference element with a long multiline-whitespace attribute and consume CPU quadratically during sanitization. CRuby 3.1 and earlier and JRuby are affected, while CRuby 3.2 and later uses linear-time regular-expression matching. The default safelist reaches the vulnerable check without a configuration change. This issue is fixed in version 2.25.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794516085574,"publishedAt":1794516085574,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"}],"remediation":[],"revision":"0591bc6dbe9afcbaf91c47a1b1affdd9d678cce70852c91686e2018fe8988e75","sources":[{"modifiedAt":1794516085574,"name":"CNA: GitHub_M","retrievedAt":1794517744422,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126205"}],"ssvc":null,"status":"published","title":"Loofah: Regular expression denial of service in the SVG local-reference check","updatedAt":1794517744422}