CVE catalog

CVE-2022-23517

ruby-rails-html-sanitizer: CVE-2022-23517

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.58% · Oct 25, 2026

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-rails-html-sanitizersid1.7.1-1fixed
Debianruby-rails-html-sanitizerforky1.7.1-1fixed
Debianruby-rails-html-sanitizertrixie1.6.2-1fixed
Debianruby-rails-html-sanitizerbookworm1.4.4-1fixed
Suserubygem-rails-html-sanitizeropenstack cloud crowbar 81.0.3-8.14.1fixed
Suserubygem-rails-html-sanitizeropenstack cloud crowbar 91.0.3-8.14.1fixed
Suserubygem-rails-html-sanitizerlinux enterprise high availability extension 15 sp11.0.4-150000.4.6.1fixed
Suserubygem-rails-html-sanitizerlinux enterprise high availability extension 15 sp21.0.4-150000.4.6.1fixed
Suserubygem-rails-html-sanitizerlinux enterprise high availability extension 15 sp31.0.4-150000.4.6.1fixed
Suserubygem-rails-html-sanitizerlinux enterprise high availability extension 15 sp41.0.4-150000.4.6.1fixed
Suserubygem-rails-html-sanitizerlinux enterprise high availability extension 15 sp51.0.4-150000.4.6.1fixed
Opensuserubygem-rails-html-sanitizerleap 15.41.0.4-150000.4.6.1fixed
Opensuserubygem-rails-html-sanitizerleap 15.51.0.4-150000.4.6.1fixed
Opensuserubygem-rails-html-sanitizertumbleweed1.5.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-rails-html-sanitizersourcesid1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourceforky1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourcetrixie1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourcebookworm1.4.4-1not yet assignedNot reported[1027153]
Suserubygem-rails-html-sanitizerrpmopenstack cloud crowbar 81.0.3-8.14.1Not reportedSUSE-SU-2023:3534-1Not reported
Suserubygem-rails-html-sanitizerrpmopenstack cloud crowbar 91.0.3-8.14.1Not reportedSUSE-SU-2023:3534-1Not reported
Suserubygem-rails-html-sanitizerrpmlinux enterprise high availability extension 15 sp11.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Suserubygem-rails-html-sanitizerrpmlinux enterprise high availability extension 15 sp21.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Suserubygem-rails-html-sanitizerrpmlinux enterprise high availability extension 15 sp31.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Suserubygem-rails-html-sanitizerrpmlinux enterprise high availability extension 15 sp41.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Suserubygem-rails-html-sanitizerrpmlinux enterprise high availability extension 15 sp51.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Opensuserubygem-rails-html-sanitizerrpmleap 15.41.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Opensuserubygem-rails-html-sanitizerrpmleap 15.51.0.4-150000.4.6.1Not reportedSUSE-SU-2023:3714-1Not reported
Opensuserubygem-rails-html-sanitizerrpmtumbleweed1.5.0-1.1Not reportedOPENSUSE-SU-2024:12769-1Not reported

[Debian bug #1027153]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[Debian 12 (Bookworm)]

  • [ruby-rails-html-sanitizer]Fixed
    Details (2)

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]