What’s Vulnerable › Vulnerabilities

CVE-2022-23514: Inefficient Regular Expression Complexity in Loofah

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-14 · updated 2026-06-17
• Weakness: CWE-1333

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.

Affected products

• flavorjones loofah: before 2.19.1 — fixed in 2.19.1
• Rubygems Loofah: before 2.19.1; 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.4.0 (+43) — fixed in 2.19.1

How to fix

Upgrade to a fixed version: flavorjones loofah 2.19.1; Rubygems Loofah 2.19.1. Check the vendor advisory for mitigations.

References

• https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh
• https://hackerone.com/reports/1684163
• https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
• https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh
• https://hackerone.com/reports/1684163
• https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html

Get alerted when CVE-2022-23514 or the next vulnerability affects your stack