CVE-2022-23516 - CVE House
Back to Database
Status published High CVE-2022-23516

Uncontrolled Recursion in Loofah

Vulnerability Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23516

Credits & Attribution

No credits recorded in the NVD database.

References

More from flavorjones

View All →
CVE-2022-23515
Improper neutralization of data URIs may allow XSS in Loofah
Medium 6.1
CVE-2022-23514
Inefficient Regular Expression Complexity in Loofah
High 7.5

Affected Vendor

flavorjones

View all reports →

Affected Software

loofah
Vulnerable Versions:
>= 2.2.0, < 2.19.1

Timeline

Official Publish: December 14th, 2022
Last Modified: November 3rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-674

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.