CVE-2026-126205

## Summary Loofah's HTML5 sanitizer restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\s*[^#\s].*/m`. In Ruby `^` anchors to every line start and `\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length. Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear. ## Impact An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace. The default safelist allows the elements in `SVG_ALLOW_LOCAL_HREF`, so no configuration change is required. ## Mitigation Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time. ## Credit Reported by scyoon through the Rails HackerOne program.