Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-23516 Details

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm CVEThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html CVE
https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html CVE
https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm [email protected]Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html [email protected]

Weakness Enumeration

CWE-IDCWE NameSource
CWE-674Uncontrolled Recursion[email protected]

Affected Products

ProductVersions
loofah project loofah
>= 2.2.0, < 2.19.1

CPE

  • cpe:2.3:a:loofah_project:loofah:*:*:*:*:*:ruby:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-23516
NVD Published Date:
Dec 14, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2022-23516 Details - Not Deferred