{"id":"CVE-2026-128068","aliases":["EUVD-2026-125592","GHSA-cpgf-5mjf-73p7"],"status":"published","title":"rails-html-sanitizer: Possible regular expression denial of service with certain configurations","description":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned from each line start. An attacker who supplies HTML can cause quadratic CPU consumption when an application customizes its allowed tags to include an SVG reference element such as use and permits href or xlink:href. The default allowed tag configuration is not affected. CRuby 3.2 and later uses linear-time regular expression matching for this pattern, while CRuby 3.1 and earlier and JRuby are affected. This issue is fixed in version 1.7.2.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2026-11-13T17:15:56Z","modified":"2026-11-13T18:00:04Z","fixes":[{"ecosystem":"RubyGems","package":"rails-html-sanitizer","fixed_in":["1.7.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.7.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.7.2"}]}],"versions":["1.0.3","1.0.4","1.1.0","1.2.0","1.3.0","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.6.0","1.6.0.rc1","1.6.0.rc2","1.6.1","1.6.2","1.7.0","1.7.1"]}],"products":[{"vendor":"rails","product":"rails-html-sanitizer"}],"references":[{"url":"https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7","tags":["x_refsource_CONFIRM","web"]},{"url":"https://github.com/rails/rails-html-sanitizer/commit/f776f963b9d9346271aade9cb903e793fd38e865","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/GHSA-cpgf-5mjf-73p7.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cpgf-5mjf-73p7"},{"url":"https://github.com/rails/rails-html-sanitizer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-128068","title":"rails-html-sanitizer: Possible regular expression denial of service with certain configurations","description":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned from each line start. An attacker who supplies HTML can cause quadratic CPU consumption when an application customizes its allowed tags to include an SVG reference element such as use and permits href or xlink:href. The default allowed tag configuration is not affected. CRuby 3.2 and later uses linear-time regular expression matching for this pattern, while CRuby 3.1 and earlier and JRuby are affected. This issue is fixed in version 1.7.2.","status":"published","published":"2026-11-13T17:15:56.816Z","modified":"2026-11-13T17:15:56.816Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-13T18:32:56.914802Z"}],"euvd":[{"id":"EUVD-2026-125592","description":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned from each line start. An attacker who supplies HTML can cause quadratic CPU consumption when an application customizes its allowed tags to include an SVG reference element such as use and permits href or xlink:href. The default allowed tag configuration is not affected. CRuby 3.2 and later uses linear-time regular expression matching for this pattern, while CRuby 3.1 and earlier and JRuby are affected. This issue is fixed in version 1.7.2.","status":"published","published":"2026-11-13T17:15:56Z","modified":"2026-11-13T17:15:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-13T18:39:40.254307Z"}],"ghsa":[{"id":"GHSA-cpgf-5mjf-73p7","title":"rails-html-sanitizer: Possible regular expression denial of service with certain configurations","description":"## Summary\n\n`Rails::HTML::PermitScrubber` restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\\s*[^#\\s].*/m`. In Ruby `^` anchors to every line start and `\\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.\n\n- Versions affected: `\u003e= 1.0.3, \u003c 1.7.2`\n- Not affected: `\u003c 1.0.3`\n- Fixed versions: `1.7.2`\n\nOnly Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.\n\n## Impact\n\nAn attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.\n\nApplications are affected only when the allowed tags are overridden to include an SVG reference element such as `use`, along with `href` or `xlink:href` in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3.\n\n## Workarounds\n\nRun Ruby 3.2 or later, which matches the pattern in linear time, or remove the SVG reference elements from the overridden allowed tags.\n\n## Credit\n\nReported by scyoon through the Rails HackerOne program.","status":"published","published":"2026-11-13T17:54:38Z","modified":"2026-11-13T17:54:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-13T18:22:07.691466Z"}],"osv":[{"id":"GHSA-cpgf-5mjf-73p7","title":"rails-html-sanitizer: Possible regular expression denial of service with certain configurations","description":"## Summary\n\n`Rails::HTML::PermitScrubber` restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\\s*[^#\\s].*/m`. In Ruby `^` anchors to every line start and `\\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.\n\n- Versions affected: `\u003e= 1.0.3, \u003c 1.7.2`\n- Not affected: `\u003c 1.0.3`\n- Fixed versions: `1.7.2`\n\nOnly Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.\n\n## Impact\n\nAn attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.\n\nApplications are affected only when the allowed tags are overridden to include an SVG reference element such as `use`, along with `href` or `xlink:href` in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3.\n\n## Workarounds\n\nRun Ruby 3.2 or later, which matches the pattern in linear time, or remove the SVG reference elements from the overridden allowed tags.\n\n## Credit\n\nReported by scyoon through the Rails HackerOne program.","status":"published","published":"2026-11-13T17:54:38Z","modified":"2026-11-13T18:00:04.418301666Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-13T18:23:20.653492Z"}]}}