CVE-2022-23516.yml

---
gem: loofah
cve: 2022-23516
ghsa: 3x8r-x6xp-q4vm
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm
title: "Uncontrolled Recursion in Loofah"
date: 2022-12-13
description: |
  ## Summary

  Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception.  This may lead to a denial of service through CPU resource consumption.

  ## Mitigation

  Upgrade to Loofah `>= 2.19.1`.

  Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
cvss_v3: 7.5
unaffected_versions:
  - "< 2.2.0"
patched_versions:
  - ">= 2.19.1"
related:
  url:
    - https://cwe.mitre.org/data/definitions/674.html