CVE catalog

CVE-2022-23514

ruby-loofah: CVE-2022-23514

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.83% · Oct 25, 2026

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-loofahsid2.25.2-1fixed
Debianruby-loofahforky2.25.2-1fixed
Debianruby-loofahtrixie2.24.0-1fixed
Debianruby-loofahbookworm2.19.1-1fixed
Suserubygem-loofahlinux enterprise high availability extension 15 sp12.2.2-150000.4.9.1fixed
Suserubygem-loofahlinux enterprise high availability extension 15 sp22.2.2-150000.4.9.1fixed
Suserubygem-loofahlinux enterprise high availability extension 15 sp32.2.2-150000.4.9.1fixed
Suserubygem-loofahlinux enterprise high availability extension 15 sp42.2.2-150000.4.9.1fixed
Opensuserubygem-loofahleap 15.42.2.2-150000.4.9.1fixed
Opensuserubygem-loofahtumbleweed2.19.1-1.1fixed
Ubunturuby-loofah16.042.0.2-1vulnerable
Ubunturuby-loofah16.042.0.3-1vulnerable
Ubunturuby-loofah16.042.0.3-2vulnerable
Ubunturuby-loofah16.042.0.3-2+deb9u1build0.16.04.1vulnerable
Ubunturuby-loofah16.042.0.3-2+deb9u2build0.16.04.1vulnerable
Ubunturuby-loofah16.042.0.3-2+deb9u3build0.16.04.1vulnerable
Ubunturuby-loofah18.042.0.3-2vulnerable
Ubunturuby-loofah18.042.2.2-1vulnerable
Ubunturuby-loofah20.042.2.3-1vulnerable
Ubunturuby-loofah20.042.3.1+dfsg-1vulnerable
Ubunturuby-loofah20.042.4.0+dfsg-1vulnerable
Ubunturuby-loofah22.042.12.0-1vulnerable
Ubunturuby-loofah22.042.13.0-1vulnerable
Ubunturuby-loofah22.042.13.0-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-loofahsourcesid2.19.1-1not yet assignedNot reported[1026083]
Debianruby-loofahsourceforky2.19.1-1not yet assignedNot reported[1026083]
Debianruby-loofahsourcetrixie2.19.1-1not yet assignedNot reported[1026083]
Debianruby-loofahsourcebookworm2.19.1-1not yet assignedNot reported[1026083]
Suserubygem-loofahrpmlinux enterprise high availability extension 15 sp12.2.2-150000.4.9.1Not reportedSUSE-SU-2023:1657-1Not reported
Suserubygem-loofahrpmlinux enterprise high availability extension 15 sp22.2.2-150000.4.9.1Not reportedSUSE-SU-2023:1657-1Not reported
Suserubygem-loofahrpmlinux enterprise high availability extension 15 sp32.2.2-150000.4.9.1Not reportedSUSE-SU-2023:1657-1Not reported
Suserubygem-loofahrpmlinux enterprise high availability extension 15 sp42.2.2-150000.4.9.1Not reportedSUSE-SU-2023:1657-1Not reported
Opensuserubygem-loofahrpmleap 15.42.2.2-150000.4.9.1Not reportedSUSE-SU-2023:1657-1Not reported
Opensuserubygem-loofahrpmtumbleweed2.19.1-1.1Not reportedOPENSUSE-SU-2024:12768-1Not reported

[Debian bug #1026083]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-loofah]Unknown

    Source package: [rubygem-loofah]

    Details (1)

    • 2.25.0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.19.1-1.1

      Version impact unknown

      dsa · rubygem-loofah · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ruby-loofah]Fixed
    Details (2)

    • 2.19.1-1 · all · bookworm

      Fixed · Fixed: 2.19.1-1

      dsa · ruby-loofah · debian · bookworm

    • 2.19.1-1 · all · bookworm

      Fixed · Fixed: 2.19.1-1

      dsa · ruby-loofah · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]