CVE-2026-126205

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG_ALLOW_LOCAL_HREF with a regular expression whose line anchor and newline-matching whitespace cause an all-whitespace value to be rescanned from every line start. An attacker can submit an SVG reference element with a long multiline-whitespace attribute and consume CPU quadratically during sanitization. CRuby 3.1 and earlier and JRuby are affected, while CRuby 3.2 and later uses linear-time regular-expression matching. The default safelist reaches the vulnerable check without a configuration change. This issue is fixed in version 2.25.3.

• CWE-400
• CWE-1333

• https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1
• https://github.com/flavorjones/loofah/pull/324
• https://github.com/flavorjones/loofah/releases/tag/v2.25.3
• https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126198pgEdge Postgres MCP Server enables SQL queries against Postg…3.1
• CVE-2026-126199pgEdge Postgres MCP Server enables SQL queries against Postg…6.8
• CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2026-12620The GridTime 3000 GNSS Time Server leaks the access token in…6.5
• CVE-2026-126203Loofah is a general library for manipulating and transformin…6.1
• CVE-2026-126204express-rate-limit is a basic rate-limiting middleware for E…3.7
• CVE-2026-126206Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126207Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126208Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126209Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-126210@hono/node-server allows running the Hono application on Nod…5.3