PT-2022-16046 · Loofah+5 · Loofah+5

Flavorjones · Published 2022-12-13 · Updated 2026-03-13 · CVE-2022-23516

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Loofah versions 2.2.0 through 2.19.0

Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption.

Recommendations For Loofah versions 2.2.0 through 2.19.0, upgrade to version 2.19.1 to resolve the issue. As a temporary workaround for users who are unable to upgrade, consider limiting the length of the strings that are sanitized to mitigate the vulnerability.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2023-1338

ALT-PU-2023-4267

ALT-PU-2024-7813

CVE-2022-23516

DLA-3565-1

DLA-3901-1

GHSA-3X8R-X6XP-Q4VM

OPENSUSE-SU-2024:12768-1

OPENSUSE-SU-2024:14171-1

OPENSUSE-SU-2025:15120-1

OPENSUSE-SU-2026:10353-1

RHSA-2023:2097

RLSA-2023:2097

SUSE-SU-2023:1657-1

Affected Products

Alt Linux

Astra Linux

Loofah

Nokogiri

Rocky Linux

Suse

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23516.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2022-23516.yml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23516 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23516 · Security Note
• https://ubuntu.com/security/CVE-2022-23516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23516 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-23516 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23516 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3565-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3x8r-x6xp-q4vm · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10353-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12768-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15120-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3901-1 · Vendor Advisory