{"cve":"CVE-2022-23516","nvd":{"published":"2022-12-14T14:15:10.627","modified":"2026-06-17T04:30:16.837","status":"Modified","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception.  This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-674"],"references":["https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm","https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html","https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm","https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html"],"products":["loofah_project:loofah"],"source":"nvd","synced_at":"2026-10-19T21:37:28.463369388+00:00"},"epss":{"cve":"CVE-2022-23516","score":0.01167,"percentile":0.67358,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3x8r-x6xp-q4vm","url":"https://osv.dev/vulnerability/GHSA-3x8r-x6xp-q4vm","summary":"Uncontrolled Recursion in Loofah","modified":"2025-11-04T17:02:06.796489Z","packages":[{"ecosystem":"RubyGems","name":"loofah","purl":"pkg:gem/loofah","ranges":[">=2.2.0 <2.19.1"],"fixed":["2.19.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}