https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:37:37.503197+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-06514 bdu:2024-06514 2026-10-03T14:37:37.735873+00:00 bdu:2024-06514 https://cve.radiocsirt.org/vuln/euvd-2026-258333 EUVD-2026-258333 2026-10-03T14:37:37.735907+00:00 EUVD-2026-258333 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23517 fkie_cve-2022-23517 2026-10-03T14:37:37.735921+00:00

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

 https://cve.radiocsirt.org/vuln/ghsa-5x79-w82f-gw8w GHSA-5x79-w82f-gw8w — Inefficient Regular Expression Complexity in rails-html-sanitizer 2026-10-03T14:37:37.735951+00:00

Affected: RubyGems: rails-html-sanitizer

## Summary

Certain configurations of rails-html-sanitizer `< 1.4.4` use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.

## Mitigation

Upgrade to rails-html-sanitizer `>= 1.4.4`.

## Severity

The maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## References

- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html) - https://hackerone.com/reports/1684163

## Credit

This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).

 https://cve.radiocsirt.org/vuln/gsd-2022-23517 gsd-2022-23517 2026-10-03T14:37:37.735985+00:00 gsd-2022-23517 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12769-1 openSUSE-SU-2024:12769-1 — ruby3.1-rubygem-rails-html-sanitizer-1.5.0-1.1 on GA media 2026-10-03T14:37:37.735997+00:00

ruby3.1-rubygem-rails-html-sanitizer-1.5.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:2097 RHSA-2023:2097 — Red Hat Security Advisory: Satellite 6.13 Release 2026-10-03T14:37:37.736015+00:00

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaug…

 https://cve.radiocsirt.org/vuln/suse-su-2023:3534-1 SUSE-SU-2023:3534-1 — Security update for rubygem-rails-html-sanitizer 2026-10-03T14:37:37.736074+00:00

Security update for rubygem-rails-html-sanitizer

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23517 UBUNTU-CVE-2022-23517 2026-10-03T14:37:37.736091+00:00

Affected: Ubuntu:16.04:LTS: ruby-rails-html-sanitizer, Ubuntu:18.04:LTS: ruby-rails-html-sanitizer, Ubuntu:20.04:LTS: ruby-rails-html-sanitizer, Ubuntu:22.04:LTS: ruby-rails-html-sanitizer, Ubuntu:24.04:LTS: ruby-rails-html-sanitizer, Ubuntu:25.10: ruby-rails-html-sanitizer, Ubuntu:26.04:LTS: ruby-rails-html-sanitizer

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1143 WID-SEC-W-2023-1143 — Red Hat Satellite: Mehrere Schwachstellen 2026-10-03T14:37:37.736120+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.