Answer in brief
CVE-2026-126205 records a Medium severity (CVSS 5.3) vulnerability in Loofah: Regular expression denial of service in the SVG local-reference check. The current sources do not mark it as known exploited. The current feed maps flavorjones/loofah (generic), loofah (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps flavorjones/loofah (generic), loofah (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| flavorjones/loofahgeneric | <2.25.3 | 2.25.3 |
| loofahrubygems | <2.25.3 | 2.25.3 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG_ALLOW_LOCAL_HREF with a regular expression whose line anchor and newline-matching whitespace cause an all-whitespace value to be rescanned from every line start. An attacker can submit an SVG reference element with a long multiline-whitespace attribute and consume CPU quadratically during sanitization. CRuby 3.1 and earlier and JRuby are affected, while CRuby 3.2 and later uses linear-time regular-expression matching. The default safelist reaches the vulnerable check without a configuration change. This issue is fixed in version 2.25.3.
Quoted source text, attributed separately from HOL analysis.